File name	1233705b8e83d408_aum.log
File size	693 bytes
File type	ASCII text, with CRLF line terminators
MD5	bfcb160c2c39fa96551cde8c63e307d1
SHA1	6f2c13c8074757b9095b5502394d6ef8b1ab3cc5
SHA256	1233705b8e83d4088b55159e49f2a9366b01ca79e55ce6b211b88f65a1ae8912
SHA512	06e458292d33025c915fe75cc99a757fbe316e05c76bca73af5965696c2380380bda5209e6edff32f60069af78d5f63fe34cc45fbff4e070741a74eb223af213
Ssdeep	12:pJdBQHjYcfRjnWBxVAPbBB8ReS/UUfh5OJDDxQbVm:pJdBQ/48bBme3UZ5OJhQbVm
Yara	None matched
VirusTotal	Search for Analysis

File name	2d562790a4ab37ed_a9r8013.tmp
File size	358 bytes
File type	PDF document, version 1.6
MD5	b4f975efe1bd35a1d60f9aceddccf601
SHA1	51477dd6aaef83a096db16c3f353860195dea610
SHA256	2d562790a4ab37ed4e3c7d0db3d1b8f9538e6035e650f3471b4716b66829b747
SHA512	d21ecee2859c1bdce166dfd6603ecfc4436a56bd1fb72894e81f7dfe6ed95ad2e2403249e4f11bf830c191d63c5b70ccc897b6082d2fcdb149d1ac6e70c6b755
Ssdeep	6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROOEmbQGXrg+ZDmbQGXrg+FCSyAAO:IngVMre9T0HQIDmy9g06JX0mbVrgmDmv
Yara	None matched
VirusTotal	Search for Analysis

File name	0a84bb9fa5c3aa10_adobeupdaterprefs.dat
File size	350 bytes
File type	XML 1.0 document, ASCII text
MD5	af9d3cf49218daaf79611f0e217da690
SHA1	6cf45202302cbc733918deab0b43304fff6e47e4
SHA256	0a84bb9fa5c3aa10f5595a4403e5b50582f8bbf25f300b13629945fc9c7d8644
SHA512	5d4cb192c542e986857fd0e1453cab94d9be93a33604ec70429d42d4e3cf7b5cd28f071d52119f02a35b87e1fee87ee95e21dd4dc75e4b242d92fb8f8f86f376
Ssdeep	6:TMVBdxwleWCEARm5z3a2AY57UBxayt4M0RuJASJ1rAG6FHrpL1sPu1Wn7qjcbN9L:TMHdxyjnWBxV4buJX1UC5G2QpG
Yara	None matched
VirusTotal	Search for Analysis

File name	3295328e4dc21218_AdobeMissingComps.xml_
File size	424 bytes
File type	XML 1.0 document, ASCII text
MD5	352d62a70eea8f62c6e07fcd06cce9da
SHA1	56847537d5da9c9920a20f06f01ec43a811b3384
SHA256	3295328e4dc2121800c8c3778f5f76a7e4ecefe6c96cc33b01fd4d55f7f61d33
SHA512	8f27dc4d32128937e5854200716afd71591319e2863158f07114adc3160b89f6cb55b0a1f580e8830f829033ad1c6ed830b491de304c2e932ba93335cf6adbcb
Ssdeep	6:TMVBdxww1UgwH0QEHa6Nbv9J1CiSHCq3/K0OMXRVeCpEG1i:TMHdxnOXbuFX1CiECI/K0OMXzeCpEGw
Yara	None matched
VirusTotal	Search for Analysis

File name	2734c91d590c012c_shareddataevents
File size	3072 bytes
File type	SQLite 3.x database
MD5	46ec71619b08907f88336f072019a7d9
SHA1	db1dabd70871c52f15e9f2a1b1c0e2e831e62ccb
SHA256	2734c91d590c012cc83137e1da60cecdc8d42bce639beb8a83d00451bb38f976
SHA512	46139079af0886c9e9077457f7d9b92384ed52357610a11b7a6244167f7f9669d3c5ad80e984c8c9836d491c33cf9dbaa84e5eebd27c57231887f427e7e68289
Ssdeep	12:HLS0qgtO9OiyopOz2VVXet3aQK+GyMFO+rlhurs7qllZ2/nMB4h2:r8Rx/XYKQvGJF7ursClZuMB4c
Yara	None matched
VirusTotal	Search for Analysis

File name	4d7f480cf854fe56_acecache10.lst
File size	1565 bytes
File type	data
MD5	abb1825273c1e859babb41ac8a72af31
SHA1	b609942e14a3fd142cce39cf68ea47f08e79963c
SHA256	4d7f480cf854fe56292ba57dc64ebb5242e9641408fe8f6e02e54afadfbb1a7f
SHA512	269f74daf146522bb5f074bf803d3b22e5c00b0bbc83f2a9df41601d8beddbff97de78df7bdca34482766c9965dcb7b5158acd6b657ccd7391fd81d7c1f1498d
Ssdeep	24:ehkFwRfC0yJrBtkRlxFX5C0yJrK3l9XhqXbx8xqdXhqbFBC0yJrBWlV:e/Rq0yROlY0ysl1heaoVhj0yilV
Yara	None matched
VirusTotal	Search for Analysis

File name	36de7efc0bfd1ca5_a9r8012.tmp
File size	358 bytes
File type	PDF document, version 1.6
MD5	589dc0dd46d177d1a4ec029f641d2608
SHA1	27c6f1bc37935a4132b4cb4bc3b6d36848eb7a2e
SHA256	36de7efc0bfd1ca5e3f287e2f8df8d0a65fcc0c5fa16e2b50e3f6192721607a6
SHA512	1500d74015ce895e16d30bf0bceda75577c3215ab3dffd960da6d0dbb55009c625548548ed74c841929ddd98569ed3563010a1ecfcf6488341f047ff249222f4
Ssdeep	6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROOZnAdoCdoDCCSyAAO:IngVMre9T0HQIDmy9g06JXJAdoCdoDCR
Yara	None matched
VirusTotal	Search for Analysis

File name	468d364bf1f8954a_updater.log
File size	1543 bytes
File type	ASCII text, with CRLF line terminators
MD5	c6b7395c8557c10013eab7f8c7b87817
SHA1	1a24f2c18c98aa557e9b524100c744f4f59ce5c3
SHA256	468d364bf1f8954a68b36564402813be0f67c355444542b867186816ff4326fc
SHA512	a6ff4fd6f6d5eb47f41f5e1f1d57016ebcaa6a1c7120c24afa9e4535000ae04520e2689578a1977f1afefaefcefd4701a842a7ff8921902965f460cdffaef3e6
Ssdeep	48:0s2SUWHSSrS6hSUWHSSrS+SUWHSSrSb8pxetRfs:0LW5rXW5rbW5rc8pxejs
Yara	None matched
VirusTotal	Search for Analysis

File name	a479dd2807cb9817_ArmUI.ini
File size	163994 bytes
File type	Little-endian UTF-16 Unicode text, with CRLF line terminators
MD5	927e703153e62a1cb9a4437659144bda
SHA1	d293a6eb612b6c3bcddeec698e40dbebb5c61879
SHA256	a479dd2807cb9817ef3ef7a31f3b7582339785e921b4284e55a1387dc38ec770
SHA512	0a1d099fccceadb38c7326a9791da18ddeff069600359b415744ae46641b8f041e4a31b00281a996f54b0991dbdf7bdbd0701f6cb71189afd42c207c4631d228
Ssdeep	3072:kT4CJ4WTbmKk61NmSTBjDT7lV8MztutF4NVxcCXXYAF5CPD:9EYJ
Yara	None matched
VirusTotal	Search for Analysis

File name	2a2e0ba33d793244_usercache.bin
File size	9662 bytes
File type	data
MD5	912bc7140ba3596f83450d830b7c9557
SHA1	0bae66884a3e091bd6095923d4add3984f3e8db2
SHA256	2a2e0ba33d79324445847a0128ca611fcc50c82a3556fa9a1478405f990843d2
SHA512	e9e45522441f2dfcfb2cd273be300a0b2add972c62f7496326a3fc5c45e4f318ca4d446ae2676360958429e39b91c1a7ee677a95d710d2936d5d48b1854dc3f1
Ssdeep	96:stIHhqWwdwlvw5SR73kAUVokJUJ0JMSJ81Wkhg28c1qOeN6hLWjAHo+1rOAq8oNs:sHWwdwlvwsR3UVoLpB+OeN6LWwTAAk8
Yara	None matched
VirusTotal	Search for Analysis

File name	d2f8b9a28940b9a5_adobearm.log
File size	3030 bytes
File type	ASCII text, with CRLF, CR line terminators
MD5	81b4fc2e07e176e9e350c472185bc4f8
SHA1	3f3b11d5b302abaa44ab87b0e5a51826159f040b
SHA256	d2f8b9a28940b9a566c24bc5d65f9f3a28b44b55049ea32ab39976bb523d6f91
SHA512	12657ad6b6c2002e4f5c95376a219bc0f2fb7120981fa05dc732c602cad57635a178aa3ec8a3f6c4629b1cbdbfd99adde839069fe35ccb1bafedc92ca254153b
Ssdeep	48:ob17Q2eMbJ5d1rogAafH5L1XQmaI7Z5z1DkieM7t521/f38KrzcZ0P:ob1kFmJ5d1sNsH5L1A1aZ5z1A52t521r
Yara	None matched
VirusTotal	Search for Analysis

File name	226d1c9926375880_d3d9caps.dat
File size	664 bytes
File type	data
MD5	cb55ec1dd48909519dcefd9d9c6ef149
SHA1	1c67abfcf1d362a32f42014501da960fee7deba5
SHA256	226d1c9926375880d590fdb098f0038cbb148edaa171cddb7ddbbfc49b56378f
SHA512	8ba52cc052fe16c50346fc9daece8a1139527b3fae6b04a7d41c8929f9cdd8f85f556fc9099fa1e0d847d80961830959e2b726d579906dfd5d0feb269fb79f44
Ssdeep	3:ZllKbllVnIlqQRi5BBl//lHlljlfltl+lp/5tAalB/AMlGM/JlpllDlHl/lotmoK:8b/+Ni///r1aR5tAanDGM/J+I4llCl
Yara	None matched
VirusTotal	Search for Analysis

File name	0b9a8988ac1040d3_AdobeMissingComps.xml
File size	424 bytes
File type	XML 1.0 document, ASCII text
MD5	f98038dbb44643e55457f5a67d97ac6b
SHA1	a8e7197c187ac72b164ed0d4ad2079d25fcaae8e
SHA256	0b9a8988ac1040d34a8df840c33f2e6c272fc456d1478035543162aaf33a7625
SHA512	3ccdb3ffc96c9a835bc15badf860ff19fc9b6ba476270df157cbcbaf4f757402348565bd475110c31c45271912611ae382fd233e0c8abff18127210fe45fa21d
Ssdeep	6:TMVBdxww1UgwH0QEHa60gSJ1CiSHCq3/K0OMXRVeCpEG1i:TMHdxnOXbuL61CiECI/K0OMXzeCpEGw
Yara	None matched
VirusTotal	Search for Analysis

File name	47f1892c02460c80_aumlib.log
File size	1556 bytes
File type	ASCII text, with CRLF line terminators
MD5	87c8709d1c09879b4c54ea4b3df3d48f
SHA1	954c4e8d30e01578d26497172ddb939267ac4b75
SHA256	47f1892c02460c803a1e47a41de28cf8e7948c46bedd71ab59f1d6597c45e9ae
SHA512	994be124c3d8dd39435a4dced8e26ccbb10425f77b431bd338d3fa50c713b16861f39f1c32dcb10064841a44610bad3b03891b29a4f82ba75a48196537024eb6
Ssdeep	24:TJiPih7X54TF8xJXgXQmPYBcJnszhM8XITFT8NPFcvnbFh:TJwiB0W/wX0cJszd2R85Qnb/
Yara	None matched
VirusTotal	Search for Analysis

Timestamp	Thread	Function	Arguments	Status	Return	Repeated

Timestamp	Thread	Function	Arguments	Status	Return	Repeated
2016-11-03 00:17:02.961382		LdrLoadDll	basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => C:\WINDOWS\system32\kernel32.dll	SUCCESS
2016-11-03 00:17:03.072382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.072382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.082382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AGM.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AGM.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.082382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AGM.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AGM.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.082382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\CoolType.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\CoolType.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.082382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\CoolType.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\CoolType.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.082382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\BIB.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\BIB.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.082382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\BIB.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\BIB.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.092382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ACE.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ACE.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.092382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ACE.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ACE.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.092382		LdrLoadDll	basename => advapi32 module_address => 0x77dd0000 flags => 0 module_name => advapi32.dll	SUCCESS
2016-11-03 00:17:03.092382		LdrLoadDll	basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32.dll	SUCCESS
2016-11-03 00:17:03.092382		LdrLoadDll	basename => advapi32 module_address => 0x77dd0000 flags => 0 module_name => advapi32.dll	SUCCESS
2016-11-03 00:17:03.092382		NtOpenFile	file_handle => 0x0000006c filepath => \Device\KsecDD desired_access => 0x00100001 filepath_r => \Device\KsecDD open_options => 16 status_info => 0 share_access => 7	SUCCESS
2016-11-03 00:17:03.092382		NtOpenFile	file_handle => 0x00000070 filepath => C:\WINDOWS\system32\wininet.dll desired_access => 0x001200a9 filepath_r => \??\C:\WINDOWS\system32\WININET.dll open_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.092382		NtOpenFile	file_handle => 0x00000000 filepath => C:\WINDOWS\system32\WININET.dll.123.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\WINDOWS\system32\WININET.dll.123.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.092382		NtOpenFile	file_handle => 0x00000000 filepath => C:\WINDOWS\system32\WININET.dll.123.Config desired_access => 0x001200a9 filepath_r => \??\C:\WINDOWS\system32\WININET.dll.123.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.102382		LdrLoadDll	basename => comctl32 module_address => 0x773d0000 flags => 0 module_name => comctl32.dll	SUCCESS
2016-11-03 00:17:03.102382		LdrLoadDll	basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32.dll	SUCCESS
2016-11-03 00:17:03.102382		LdrLoadDll	basename => AcroRd32 module_address => 0x009f0000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.dll	SUCCESS
2016-11-03 00:17:03.102382		NtOpenFile	file_handle => 0x000000a0 filepath => C:\WINDOWS\system32\rpcss.dll desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32\rpcss.dll open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.112382		LdrLoadDll	basename => uxtheme module_address => 0x5ad70000 flags => 0 module_name => C:\WINDOWS\system32\uxtheme.dll	SUCCESS
2016-11-03 00:17:03.112382		LdrLoadDll	basename => uxtheme module_address => 0x5ad70000 flags => 0 module_name => uxtheme.dll	SUCCESS
2016-11-03 00:17:03.112382		LdrLoadDll	basename => uxtheme module_address => 0x5ad70000 flags => 0 module_name => C:\WINDOWS\system32\uxtheme.dll	SUCCESS
2016-11-03 00:17:03.112382		LdrLoadDll	basename => uxtheme module_address => 0x5ad70000 flags => 0 module_name => C:\WINDOWS\system32\uxtheme.dll	SUCCESS
2016-11-03 00:17:03.112382		LdrLoadDll	basename => uxtheme module_address => 0x5ad70000 flags => 0 module_name => C:\WINDOWS\system32\uxtheme.dll	SUCCESS
2016-11-03 00:17:03.112382		LdrLoadDll	basename => Comctl32 module_address => 0x773d0000 flags => 0 module_name => Comctl32.dll	SUCCESS
2016-11-03 00:17:03.112382		LdrLoadDll	basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32.dll	SUCCESS
2016-11-03 00:17:03.112382		LdrLoadDll	basename => BIB module_address => 0x07000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\BIB.dll	SUCCESS
2016-11-03 00:17:03.112382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Esl\aiodlite.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Esl\aiodlite.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.112382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Esl\aiodlite.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Esl\aiodlite.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.112382		LdrLoadDll	basename => aiodlite module_address => 0x10000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Esl\aiodlite.dll	SUCCESS
2016-11-03 00:17:03.112382		LdrLoadDll	basename => ADVAPI32 module_address => 0x77dd0000 flags => 0 module_name => C:\WINDOWS\system32\ADVAPI32.DLL	SUCCESS
2016-11-03 00:17:03.112382		LdrLoadDll	basename => ieframe module_address => 0x00000000 flags => 0 module_name => C:\WINDOWS\system32\ieframe.dll	FAILURE
2016-11-03 00:17:03.112382		LdrLoadDll	basename => acrord32 module_address => 0x009f0000 flags => 0 module_name => c:\program files\adobe\reader 9.0\reader\acrord32.dll	SUCCESS
2016-11-03 00:17:03.122382		LdrLoadDll	basename => UxTheme module_address => 0x5ad70000 flags => 0 module_name => UxTheme.dll	SUCCESS
2016-11-03 00:17:03.122382		NtOpenFile	file_handle => 0x000000b0 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.142382		NtOpenFile	file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.142382		NtCreateFile	create_disposition => 2 file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\Adobe desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe create_options => 16417 status_info => 2 share_access => 3	SUCCESS
2016-11-03 00:17:03.142382		NtOpenFile	file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.142382		NtCreateFile	create_disposition => 2 file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat create_options => 16417 status_info => 2 share_access => 3	SUCCESS
2016-11-03 00:17:03.142382		NtOpenFile	file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.142382		NtCreateFile	create_disposition => 2 file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0 desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0 create_options => 16417 status_info => 2 share_access => 3	SUCCESS
2016-11-03 00:17:03.142382		NtOpenFile	file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.142382		NtOpenFile	file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.142382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\UserCache.bin desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\UserCache.bin create_options => 100 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.162382		LdrLoadDll	basename => ole32 module_address => 0x774e0000 flags => 0 module_name => ole32.dll	SUCCESS
2016-11-03 00:17:03.162382		CoInitializeEx	options => 6	FAILURE
2016-11-03 00:17:03.162382		LdrLoadDll	basename => SHELL32 module_address => 0x7c9c0000 flags => 0 module_name => C:\WINDOWS\system32\SHELL32.dll	SUCCESS
2016-11-03 00:17:03.162382		LdrLoadDll	basename => SETUPAPI module_address => 0x77920000 flags => 0 module_name => SETUPAPI.dll	SUCCESS
2016-11-03 00:17:03.162382		LdrLoadDll	basename => rpcrt4 module_address => 0x77e70000 flags => 0 module_name => rpcrt4.dll	SUCCESS
2016-11-03 00:17:03.162382		NtCreateFile	create_disposition => 1 file_handle => 0x000000f8 filepath => \\?\PIPE\lsarpc desired_access => 0xc0100080 file_attributes => 0 filepath_r => \??\PIPE\lsarpc create_options => 64 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.162382		NtWriteFile	buffer => H ¸¸ xW44Í«ï #Eg‰«]ˆŠëÉŸè+H` file_handle => 0x000000f8 offset => 0	SUCCESS
2016-11-03 00:17:03.162382		NtCreateFile	create_disposition => 1 file_handle => 0x000000f4 filepath => \\?\PIPE\lsarpc desired_access => 0xc0100080 file_attributes => 0 filepath_r => \??\PIPE\lsarpc create_options => 64 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.162382		NtWriteFile	buffer => H ¸¸ xW44Í«ï #Eg‰«]ˆŠëÉŸè+H` file_handle => 0x000000f4 offset => 0	SUCCESS
2016-11-03 00:17:03.162382		NtOpenFile	file_handle => 0x000000fc filepath => \??\IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3131303066333036662020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} desired_access => 0x00100080 filepath_r => \??\IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3131303066333036662020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} open_options => 96 status_info => 0 share_access => 3	SUCCESS
2016-11-03 00:17:03.162382		NtOpenFile	file_handle => 0x000000fc filepath => \??\IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3131303066333036662020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} desired_access => 0x00100080 filepath_r => \??\IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3131303066333036662020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} open_options => 16 status_info => 0 share_access => 3	SUCCESS
2016-11-03 00:17:03.162382		NtCreateFile	create_disposition => 1 file_handle => 0x000000fc filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3	SUCCESS
2016-11-03 00:17:03.162382		NtOpenFile	file_handle => 0x000000fc filepath => \??\STORAGE#Volume#1&30a96598&0&SignatureEBD7EBD7Offset7E00Length9FF2E4A00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} desired_access => 0x00100080 filepath_r => \??\STORAGE#Volume#1&30a96598&0&SignatureEBD7EBD7Offset7E00Length9FF2E4A00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} open_options => 96 status_info => 0 share_access => 3	SUCCESS
2016-11-03 00:17:03.162382		NtOpenFile	file_handle => 0x000000fc filepath => \??\STORAGE#Volume#1&30a96598&0&SignatureEBD7EBD7Offset7E00Length9FF2E4A00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} desired_access => 0x00100080 filepath_r => \??\STORAGE#Volume#1&30a96598&0&SignatureEBD7EBD7Offset7E00Length9FF2E4A00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} open_options => 16 status_info => 0 share_access => 3	SUCCESS
2016-11-03 00:17:03.162382		NtCreateFile	create_disposition => 1 file_handle => 0x000000fc filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3	SUCCESS
2016-11-03 00:17:03.162382		NtCreateFile	create_disposition => 1 file_handle => 0x000000fc filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3	SUCCESS
2016-11-03 00:17:03.162382		NtCreateFile	create_disposition => 1 file_handle => 0x000000fc filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3	SUCCESS
2016-11-03 00:17:03.162382		NtCreateFile	create_disposition => 1 file_handle => 0x000000fc filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3	SUCCESS
2016-11-03 00:17:03.162382		NtCreateFile	create_disposition => 1 file_handle => 0x000000fc filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3	SUCCESS
2016-11-03 00:17:03.162382		NtOpenFile	file_handle => 0x00000100 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.162382		LdrLoadDll	basename => SHELL32 module_address => 0x7c9c0000 flags => 0 module_name => SHELL32.dll	SUCCESS
2016-11-03 00:17:03.162382		LdrLoadDll	basename => ole32 module_address => 0x774e0000 flags => 0 module_name => ole32.dll	SUCCESS
2016-11-03 00:17:03.162382		NtOpenFile	file_handle => 0x00000108 filepath => C:\Program Files\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.172382		CoUninitialize		SUCCESS
2016-11-03 00:17:03.172382		LdrLoadDll	basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll	SUCCESS
2016-11-03 00:17:03.172382		NtOpenFile	file_handle => 0x00000108 filepath => C:\Program Files\Common Files\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.172382		CoInitializeEx	options => 6	FAILURE
2016-11-03 00:17:03.172382		NtOpenFile	file_handle => 0x000000fc filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.172382		NtOpenFile	file_handle => 0x000000fc filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.172382		NtOpenFile	file_handle => 0x000000fc filepath => C:\Documents and Settings\ardi\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.172382		NtOpenFile	file_handle => 0x000000fc filepath => C:\Documents and Settings\ardi\Local Settings\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.172382		CoUninitialize		SUCCESS
2016-11-03 00:17:03.172382		NtOpenFile	file_handle => 0x000000fc filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.172382		NtOpenFile	file_handle => 0x000000fc filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.172382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeComFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeComFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.172382		LdrLoadDll	basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll	SUCCESS
2016-11-03 00:17:03.172382		LdrLoadDll	basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll	SUCCESS
2016-11-03 00:17:03.172382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Adobe\Fonts\Reqrd\CMaps\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\Fonts\Reqrd\CMaps\ open_options => 16417 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:03.172382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Adobe\Fonts\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\Fonts\ open_options => 16417 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:03.172382		NtOpenFile	file_handle => 0x00000108 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.172382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeCMapFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeCMapFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.172382		LdrLoadDll	basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll	SUCCESS
2016-11-03 00:17:03.172382		LdrLoadDll	basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll	SUCCESS
2016-11-03 00:17:03.172382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Reqrd\CMaps\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Reqrd\CMaps\ open_options => 16417 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:03.172382		NtOpenFile	file_handle => 0x00000108 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.172382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.172382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.172382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.172382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.172382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.172382		NtOpenFile	file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.172382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.172382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.172382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.172382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.172382		NtOpenFile	file_handle => 0x000000fc filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.172382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeSysFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeSysFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.182382		LdrLoadDll	basename => gdi32 module_address => 0x77f10000 flags => 0 module_name => gdi32.dll	SUCCESS
2016-11-03 00:17:03.182382		LdrLoadDll	basename => advapi32 module_address => 0x77dd0000 flags => 0 module_name => advapi32.dll	SUCCESS
2016-11-03 00:17:03.202382		NtOpenFile	file_handle => 0x000000fc filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.202382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.202382		LdrLoadDll	basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll	SUCCESS
2016-11-03 00:17:03.202382		NtOpenFile	file_handle => 0x00000108 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.202382		NtOpenFile	file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.202382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.202382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.202382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.202382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.212382		NtOpenFile	file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.212382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.212382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.212382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.212382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.212382		NtOpenFile	file_handle => 0x000000fc filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.212382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.212382		LdrLoadDll	basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll	SUCCESS
2016-11-03 00:17:03.212382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ open_options => 16417 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:03.212382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.212382		LdrLoadDll	basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll	SUCCESS
2016-11-03 00:17:03.212382		NtOpenFile	file_handle => 0x00000108 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.212382		NtOpenFile	file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.212382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.212382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.212382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.212382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.212382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.212382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.212382		NtOpenFile	file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.212382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.212382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.212382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.212382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.212382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.212382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.212382		NtOpenFile	file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.212382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.212382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.222382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.222382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.222382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.222382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.222382		NtOpenFile	file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.222382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.222382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.222382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.222382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.222382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.222382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.222382		NtOpenFile	file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.222382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.222382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.222382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.222382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.222382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.222382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.222382		NtOpenFile	file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.222382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.222382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.222382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.222382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.222382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.222382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.222382		NtOpenFile	file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.222382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.222382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.222382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.222382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.222382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.222382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.222382		NtOpenFile	file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.222382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.232382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.232382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtOpenFile	file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.232382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.232382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.232382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtOpenFile	file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.232382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.232382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.232382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtOpenFile	file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.232382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.232382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.232382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtOpenFile	file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.232382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.232382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.232382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtOpenFile	file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.232382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.232382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.232382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.232382		NtOpenFile	file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.242382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.242382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.242382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.242382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.242382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.242382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.242382		NtOpenFile	file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.242382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.242382		NtCreateFile	create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.242382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.242382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.242382		NtOpenFile	file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.242382		NtOpenFile	file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\pfm\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.242382		NtOpenFile	file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.242382		NtCreateFile	create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\pfm\SY______.PFM create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.242382		NtOpenFile	file_handle => 0x00000118 filepath => C:\Program Files\Common Files\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.242382		NtOpenFile	file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.242382		NtCreateFile	create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\pfm\SY______.PFM create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.242382		NtOpenFile	file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.242382		NtCreateFile	create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZX______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZX______.PFB create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.242382		NtCreateFile	create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZX______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZX______.PFB create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.242382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.242382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZX______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZX______.PFB create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.242382		NtOpenFile	file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.242382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\mmm\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\mmm\ open_options => 16417 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:03.242382		NtOpenFile	file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.242382		NtCreateFile	create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZY______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZY______.PFB create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.242382		NtCreateFile	create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZY______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZY______.PFB create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.242382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.242382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZY______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZY______.PFB create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.242382		NtOpenFile	file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.242382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\mmm\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\mmm\ open_options => 16417 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:03.252382		NtOpenFile	file_handle => 0x00000108 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.252382		NtOpenFile	file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.252382		NtCreateFile	create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.252382		NtCreateFile	create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.252382		NtOpenFile	file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.252382		NtCreateFile	create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.252382		NtCreateFile	create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.252382		NtOpenFile	file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.252382		NtCreateFile	create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.252382		NtCreateFile	create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.252382		NtOpenFile	file_handle => 0x000000fc filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.252382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeComFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeComFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.252382		LdrLoadDll	basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll	SUCCESS
2016-11-03 00:17:03.252382		LdrLoadDll	basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll	SUCCESS
2016-11-03 00:17:03.252382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Adobe\Fonts\Reqrd\CMaps\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\Fonts\Reqrd\CMaps\ open_options => 16417 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:03.252382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Adobe\Fonts\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\Fonts\ open_options => 16417 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:03.252382		NtOpenFile	file_handle => 0x00000108 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.252382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeCMapFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeCMapFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.252382		LdrLoadDll	basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll	SUCCESS
2016-11-03 00:17:03.252382		LdrLoadDll	basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll	SUCCESS
2016-11-03 00:17:03.252382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Reqrd\CMaps\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Reqrd\CMaps\ open_options => 16417 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:03.252382		NtOpenFile	file_handle => 0x00000108 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.252382		NtOpenFile	file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.252382		NtCreateFile	create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.252382		NtCreateFile	create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.252382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.252382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.252382		NtOpenFile	file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.252382		NtCreateFile	create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.252382		NtCreateFile	create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.252382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.252382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.252382		NtCreateFile	create_disposition => 5 file_handle => 0x000000fc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\UserCache.bin desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\UserCache.bin create_options => 96 status_info => 2 share_access => 0	SUCCESS
2016-11-03 00:17:03.252382		NtWriteFile	buffer => 4 67 75FID.1:o: :F:ArialMTP:ArialL:$  "F:Arial#89FID.1:o: :F:Arial-ItalicMTP:Arial ItalicL:$ ÿ "F:Arial#85FID.1:o: :F:Arial-BoldMTP:Arial BoldL:$¼ "F:Arial#98FID.1:o: :F:Arial-BoldItalicMTP:Arial Bold ItalicL:$¼ÿ "F:Arial#91FID.1:o: :F:Arial-BlackP:Arial BlackL:-„ "F:Arial Black#95FID.1:o: :F:ComicSansMSP:Comic Sans MSL:-  BF:Comic Sans MS#105FID.1:o: :F:ComicSansMS-BoldP:Comic Sans MS BoldL:-¼ BF:Comic Sans MS#94FID.1:o: :F:CourierNewPSMTP:Courier NewL:$  1F:Courier New#108FID.1:o: :F:CourierNewPS-ItalicMTP:Courier New ItalicL:$ ÿ 1F:Courier New#104FID.1:o: :F:CourierNewPS-BoldMTP:Courier New BoldL:$¼ 1F:Courier New#117FID.1:o: :F:CourierNewPS-BoldItalicMTP:Courier New Bold ItalicL:$¼ÿ 1F:Courier New#84FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf#92FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf#89FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf#96FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf#108FID.1:o: :F:EstrangeloEdessaP:Estrangelo EdessaL:   BF:Estrangelo Edessa#123FID.1:o: :F:FranklinGothic-MediumP:Franklin Gothic MediumL:$  "F:Franklin Gothic Medium#136FID.1:o: :F:FranklinGothic-MediumItalicP:Franklin Gothic Medium ItalicL:$ ÿ "F:Franklin Gothic Medium#79FID.1:o: :F:GautamiP:GautamiL:8   F:Gautami#79FID.1:o: :F:GeorgiaP:GeorgiaL:$  F:Georgia#93FID.1:o: :F:Georgia-ItalicP:Georgia ItalicL:$ ÿ F:Georgia#89FID.1:o: :F:Georgia-BoldP:Georgia BoldL:$¼ F:Georgia#102FID.1:o: :F:Georgia-BoldItalicP:Georgia Bold ItalicL:$¼ÿ F:Georgia#76FID.1:o: :F:ImpactP:ImpactL:'   "F:Impact#73FID.1:o: :F:LathaP:LathaL:,  F:Latha#99FID.1:o: :F:LucidaConsoleP:Lucida ConsoleL:   1F:Lucida Console#113FID.1:o: :F:LucidaSansUnicodeP:Lucida Sans UnicodeL:1  "F:Lucida Sans Unicode#84FID.1:o: :F:Mangal-RegularP:MangalL:6  F:Mangal#79FID.1:o: :F:MarlettP:MarlettL: ô  F:Marlett#116FID.1:o: :F:MicrosoftSansSerifP:Microsoft Sans SerifL:$  "F:Microsoft Sans Serif#91FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf#86FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf#88FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf#90FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf#78FID.1:o: :F:MVBoliP:MV BoliL:4  F:MV Boli#96FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf#91FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf#86FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf#88FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf#90FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf#114FID.1:o: :F:PalatinoLinotype-RomanP:Palatino LinotypeL:+  F:Palatino Linotype#122FID.1:o: :F:PalatinoLinotype-ItalicP:Palatino Linotype ItalicL:+ file_handle => 0x000000fc offset => 0	SUCCESS
2016-11-03 00:17:03.262382		NtWriteFile	buffer =>  ÿ F:Palatino Linotype#118FID.1:o: :F:PalatinoLinotype-BoldP:Palatino Linotype BoldL:+¼ F:Palatino Linotype#131FID.1:o: :F:PalatinoLinotype-BoldItalicP:Palatino Linotype Bold ItalicL:+¼ÿ F:Palatino Linotype#84FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf#73FID.1:o: :F:RaaviP:RaaviL:5  F:Raavi#76FID.1:o: :F:ShrutiP:ShrutiL:6  F:Shruti#79FID.1:o: :F:SylfaenP:SylfaenL:*   F:Sylfaen#149FID.1:k::P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFBM:C:\Program Files\Adobe\Reader 9.0\Resource\Font\pfm\SY______.PFM#78FID.1:o: :F:SymbolMTP:SymbolL:'  F:Symbol#76FID.1:o: :F:TahomaP:TahomaL:'  "F:Tahoma#86FID.1:o: :F:Tahoma-BoldP:Tahoma BoldL:'¼ "F:Tahoma#105FID.1:o: :F:TimesNewRomanPSMTP:Times New RomanL:#   F:Times New Roman#119FID.1:o: :F:TimesNewRomanPS-ItalicMTP:Times New Roman ItalicL:#  ÿ F:Times New Roman#115FID.1:o: :F:TimesNewRomanPS-BoldMTP:Times New Roman BoldL:#¼ F:Times New Roman#128FID.1:o: :F:TimesNewRomanPS-BoldItalicMTP:Times New Roman Bold ItalicL:# ¼ÿ F:Times New Roman#93FID.1:o: :F:TrebuchetMSP:Trebuchet MSL:%  "F:Trebuchet MS#107FID.1:o: :F:TrebuchetMS-ItalicP:Trebuchet MS ItalicL:% ÿ "F:Trebuchet MS#103FID.1:o: :F:TrebuchetMS-BoldP:Trebuchet MS BoldL:%¼ "F:Trebuchet MS#114FID.1:o: :F:Trebuchet-BoldItalicP:Trebuchet MS Bold ItalicL:%¼ÿ "F:Trebuchet MS#81FID.1:o: :F:Tunga-RegularP:TungaL:5  F:Tunga#79FID.1:o: :F:VerdanaP:VerdanaL:'  "F:Verdana#93FID.1:o: :F:Verdana-ItalicP:Verdana ItalicL:' ÿ "F:Verdana#89FID.1:o: :F:Verdana-BoldP:Verdana BoldL:'¼ "F:Verdana#102FID.1:o: :F:Verdana-BoldItalicP:Verdana Bold ItalicL:'¼ÿ "F:Verdana#82FID.1:o: :F:WebdingsP:WebdingsL:   F:Webdings#93FID.1:o: :F:Wingdings-RegularP:WingdingsL:$  F:Wingdings#125 6 Symbol 0 48 6 Symbol 1 49 10 AdobePiStd 0 44 8 SymbolMT 1 49 12 Verdana-Bold 1 63 7 Verdana 1 61 5 Arial 1 0 7 ArialMT 1 0 7 Marlett 1 28 12 Arial-BoldMT 1 2 18 Arial-BoldItalicMT 1 3 14 Arial-ItalicMT 1 1 14 CourierNewPSMT 1 7 19 CourierNewPS-BoldMT 1 9 25 CourierNewPS-BoldItalicMT 1 10 17 TimesNewRomanPSMT 1 52 17 LucidaSansUnicode 1 26 13 LucidaConsole 1 25 22 TimesNewRomanPS-BoldMT 1 54 28 TimesNewRomanPS-BoldItalicMT 1 55 9 Wingdings 1 66 24 TimesNewRomanPS-ItalicMT 1 53 17 Wingdings-Regular 1 66 21 CourierNewPS-ItalicMT 1 8 21 PalatinoLinotype-Bold 1 42 7 Gautami 1 18 16 EstrangeloEdessa 1 15 5 Latha 1 24 20 Trebuchet-BoldItalic 1 59 18 TrebuchetMS-Italic 1 57 18 Verdana-BoldItalic 1 64 11 Arial-Black 1 4 11 ComicSansMS 1 5 14 Verdana-Italic 1 62 6 Impact 1 23 16 ComicSansMS-Bold 1 6 16 Arial,BoldItalic 1 3 10 ArialBlack 1 4 15 ComicSansMSBold 1 6 22 MyriadCurrency-Regular 0 35 14 MyriadPro-Bold 0 38 16 MyriadPro-BoldIt 0 39 12 MyriadPro-It 0 37 15 CourierStd-Bold 0 13 22 CourierStd-BoldOblique 0 14 18 CourierStd-Oblique 0 12 10 CourierStd 0 11 14 MinionPro-Bold 0 32 16 MinionPro-BoldIt 0 33 12 MinionPro-It 0 31 17 MinionPro-Regular 0 30 17 MyriadPro-Regular 0 36 12 Georgia-Bold 1 21 18 Georgia-BoldItalic 1 22 7 Georgia 1 19 21 FranklinGothic-Medium 1 16 22 PalatinoLinotype-Roman 1 40 27 FranklinGothic-MediumItalic 1 17 14 Georgia-Italic 1 20 6 MVBoli 1 34 6 Mangal 1 27 14 Mangal-Regular 1 27 5 Raavi 1 45 5 Tunga 1 60 13 Tunga-Regular 1 60 6 Shruti 1 46 7 Sylfaen 1 47 18 MicrosoftSa file_handle => 0x000000fc offset => 0	SUCCESS
2016-11-03 00:17:03.262382		NtWriteFile	buffer => nsSerif 1 29 23 PalatinoLinotype-Italic 1 41 6 Tahoma 1 50 27 PalatinoLinotype-BoldItalic 1 43 11 Tahoma-Bold 1 51 8 Webdings 1 65 11 TrebuchetMS 1 56 16 TrebuchetMS-Bold 1 58 11 ArialItalic 1 1 10 Arial,Bold 1 2 15 ArialBoldItalic 1 3 12 Arial,Italic 1 1 9 ArialBold 1 2 16 ComicSansMS,Bold 1 6 10 CourierNew 1 7 16 CourierNewItalic 1 8 17 CourierNew,Italic 1 8 14 CourierNewBold 1 9 15 CourierNew,Bold 1 9 20 CourierNewBoldItalic 1 10 21 CourierNew,BoldItalic 1 10 20 FranklinGothicMedium 1 16 26 FranklinGothicMediumItalic 1 17 27 FranklinGothicMedium,Italic 1 17 13 GeorgiaItalic 1 20 14 Georgia,Italic 1 20 11 GeorgiaBold 1 21 12 Georgia,Bold 1 21 17 GeorgiaBoldItalic 1 22 18 Georgia,BoldItalic 1 22 16 PalatinoLinotype 1 40 22 PalatinoLinotypeItalic 1 41 23 PalatinoLinotype,Italic 1 41 20 PalatinoLinotypeBold 1 42 21 PalatinoLinotype,Bold 1 42 26 PalatinoLinotypeBoldItalic 1 43 27 PalatinoLinotype,BoldItalic 1 43 10 TahomaBold 1 51 11 Tahoma,Bold 1 51 13 TimesNewRoman 1 52 19 TimesNewRomanItalic 1 53 20 TimesNewRoman,Italic 1 53 17 TimesNewRomanBold 1 54 18 TimesNewRoman,Bold 1 54 23 TimesNewRomanBoldItalic 1 55 24 TimesNewRoman,BoldItalic 1 55 17 TrebuchetMSItalic 1 57 18 TrebuchetMS,Italic 1 57 15 TrebuchetMSBold 1 58 16 TrebuchetMS,Bold 1 58 21 TrebuchetMSBoldItalic 1 59 22 TrebuchetMS,BoldItalic 1 59 13 VerdanaItalic 1 62 14 Verdana,Italic 1 62 11 VerdanaBold 1 63 12 Verdana,Bold 1 63 17 VerdanaBoldItalic 1 64 18 Verdana,BoldItalic 1 64 0000 file_handle => 0x000000fc offset => 0	SUCCESS
2016-11-03 00:17:03.262382		CoInitializeEx	options => 2	FAILURE
2016-11-03 00:17:03.262382		CoUninitialize		SUCCESS
2016-11-03 00:17:03.272382		LdrLoadDll	basename => mscms module_address => 0x73b30000 flags => 0 module_name => mscms.dll	SUCCESS
2016-11-03 00:17:03.272382		NtOpenFile	file_handle => 0x00000118 filepath => C:\WINDOWS\system32\spool\drivers\color\ desired_access => 0x00100001 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.272382		NtOpenFile	file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Color\ desired_access => 0x00100001 filepath_r => \??\C:\WINDOWS\system32\Color\ open_options => 16417 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:03.272382		NtCreateFile	create_disposition => 2 file_handle => 0x00000118 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ create_options => 16417 status_info => 2 share_access => 3	SUCCESS
2016-11-03 00:17:03.272382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst create_options => 96 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:03.272382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst open_options => 2113600 status_info => 4294967295 share_access => 7	FAILURE
2016-11-03 00:17:03.272382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst open_options => 2113600 status_info => 4294967295 share_access => 7	FAILURE
2016-11-03 00:17:03.272382		NtCreateFile	create_disposition => 5 file_handle => 0x00000118 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst desired_access => 0x40100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst create_options => 96 status_info => 2 share_access => 3	SUCCESS
2016-11-03 00:17:03.272382		LdrLoadDll	basename => mscms module_address => 0x73b30000 flags => 0 module_name => mscms.dll	SUCCESS
2016-11-03 00:17:03.272382		NtOpenFile	file_handle => 0x0000011c filepath => C:\WINDOWS\system32\spool\drivers\color\ desired_access => 0x00100001 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.272382		NtCreateFile	create_disposition => 1 file_handle => 0x00000108 filepath => C:\WINDOWS\system32\spool\drivers\color\is330.icm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\is330.icm create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.272382		NtCreateFile	create_disposition => 1 file_handle => 0x00000108 filepath => C:\WINDOWS\system32\spool\drivers\color\kodak_dc.icm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\kodak_dc.icm create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.282382		NtCreateFile	create_disposition => 1 file_handle => 0x00000108 filepath => C:\WINDOWS\system32\spool\drivers\color\sRGB Color Space Profile.icm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\sRGB Color Space Profile.icm create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.282382		NtOpenFile	file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Color\ desired_access => 0x00100001 filepath_r => \??\C:\WINDOWS\system32\Color\ open_options => 16417 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:03.282382		NtWriteFile	buffer => CPSAÙjTdoogì C:\WINDOWS\System32\spool\DRIVERS\COLOR\is330.icm€sø’‘|ÿÿÿÿüÛ˜‘|(!‘|x=‘|0 ´s !¼c 0ܘ‘|@Š9üÜ!‘|¸ 9=‘|HŠ9sˆÜé|@‘|ÿÿÿÿ2‘|c‘| ±—|@‘|èŽ ØÛpÜÀÜé|@‘|ÿÿÿÿ¤Ü¬Ü˜‘|`3(xÝØrncs BGR baLÐTFSM|descRICOH RUSSIAN-SC 040402ÿþRICOH RUSSIAN-SC 040402RICOH RUSSIAN-SC 040402 ð8doog)C:\WINDOWS\System32\spool\DRIVERS\COLOR\kodak_dc.icmsø’‘|ÿÿÿÿüÛ˜‘|(!‘|x=‘|0 ´s !¼c 0ܘ‘|@Š9üÜ!‘|¸ 9=‘|HŠ9sˆÜé|@‘|ÿÿÿÿ2‘|c‘| ±—|@‘|èŽ ØÛpÜÀÜé|@‘|ÿÿÿÿ¤Ü¬Ü˜‘|`3(xÝØrtnm BGR baLÎ2TFSM¹descKODAK DC Series Digital Camera þÿKODAK DC Series Digital CameraKODAK DC Series Digital Camera ħdoogÜ C:\WINDOWS\System32\spool\DRIVERS\COLOR\sRGB Color Space Profile.icm˜‘|(!‘|x=‘|0 ´s !¼c 0ܘ‘|@Š9üÜ!‘|¸ 9=‘|HŠ9sˆÜé|@‘|ÿÿÿÿ2‘|c‘| ±—|@‘|èŽ ØÛpÜÀÜé|@‘|ÿÿÿÿ¤Ü¬Ü˜‘|`3(xÝØrtnm BGR ZYX TRCÎ 1TFSMldescsRGB IEC61966-2.1sRGB IEC61966-2.1 ?Ú.ÛJ‰«`¢<_|}ÝH file_handle => 0x00000118 offset => 0	SUCCESS
2016-11-03 00:17:03.282382		CoInitializeSecurity		SUCCESS
2016-11-03 00:17:03.282382		LdrLoadDll	basename => OLE32 module_address => 0x774e0000 flags => 0 module_name => OLE32	SUCCESS
2016-11-03 00:17:03.282382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.282382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.282382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.282382		LdrLoadDll	basename => OLE32 module_address => 0x774e0000 flags => 0 module_name => OLE32.DLL	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.292382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.302382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.312382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.312382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.312382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.312382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.312382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.312382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.312382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.312382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.322382		NtOpenFile	file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.342382		LdrLoadDll	basename => Annots.api module_address => 0x22100000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api	SUCCESS
2016-11-03 00:17:03.352382		LdrLoadDll	basename => Comctl32 module_address => 0x773d0000 flags => 0 module_name => Comctl32.dll	SUCCESS
2016-11-03 00:17:03.352382		LdrLoadDll	basename => ieframe module_address => 0x00000000 flags => 0 module_name => C:\WINDOWS\system32\ieframe.dll	FAILURE
2016-11-03 00:17:03.352382		NtOpenFile	file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.352382		NtOpenFile	file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.352382		NtOpenFile	file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.362382		NtOpenFile	file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.362382		NtOpenFile	file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.362382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ open_options => 16417 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:03.362382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ open_options => 16417 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:03.362382		NtOpenFile	file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.362382		NtCreateFile	create_disposition => 2 file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ create_options => 16417 status_info => 2 share_access => 3	SUCCESS
2016-11-03 00:17:03.362382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\OfflineDocs desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\OfflineDocs create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.362382		NtOpenFile	file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.362382		NtOpenFile	file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.362382		NtOpenFile	file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.362382		NtOpenFile	file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.362382		NtOpenFile	file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.362382		NtOpenFile	file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.362382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\Workflows desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\Workflows create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.362382		CoInitializeEx	options => 6	FAILURE
2016-11-03 00:17:03.362382		NtOpenFile	file_handle => 0x00000144 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.362382		NtOpenFile	file_handle => 0x00000144 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.362382		NtOpenFile	file_handle => 0x00000144 filepath => C:\Documents and Settings\ardi\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.372382		NtOpenFile	file_handle => 0x00000144 filepath => C:\Documents and Settings\ardi\Application Data\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\desktop.ini open_options => 96 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:03.372382		NtOpenFile	file_handle => 0x00000144 filepath => C:\Documents and Settings\ardi\Application Data\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\desktop.ini open_options => 96 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:03.372382		NtOpenFile	file_handle => 0x00000144 filepath => C:\Documents and Settings\ardi\Application Data\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\desktop.ini open_options => 96 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:03.372382		CoUninitialize		SUCCESS
2016-11-03 00:17:03.372382		LdrLoadDll	basename => AcroRd32.exe module_address => 0x00400000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe	SUCCESS
2016-11-03 00:17:03.372382		LdrLoadDll	basename => AcroRd32.exe module_address => 0x00400000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe	SUCCESS
2016-11-03 00:17:03.382382		LdrLoadDll	basename => ieframe module_address => 0x00000000 flags => 0 module_name => C:\WINDOWS\system32\ieframe.dll	FAILURE
2016-11-03 00:17:03.382382		NtOpenFile	file_handle => 0x00000158 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.382382		NtCreateFile	create_disposition => 1 file_handle => 0x00000158 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\APT_military procurement.pdf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\APT_military procurement.pdf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.382382		NtCreateFile	create_disposition => 1 file_handle => 0x00000158 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\APT_military procurement.pdf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\APT_military procurement.pdf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.392382		LdrLoadDll	basename => AcroForm.api module_address => 0x20800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api	SUCCESS
2016-11-03 00:17:03.402382		LdrLoadDll	basename => Comctl32 module_address => 0x773d0000 flags => 0 module_name => Comctl32.dll	SUCCESS
2016-11-03 00:17:03.402382		LdrLoadDll	basename => ieframe module_address => 0x00000000 flags => 0 module_name => C:\WINDOWS\system32\ieframe.dll	FAILURE
2016-11-03 00:17:03.402382		NtOpenFile	file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.402382		NtOpenFile	file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.402382		NtOpenFile	file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.402382		NtOpenFile	file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.402382		NtOpenFile	file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.402382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ open_options => 16417 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:03.402382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ open_options => 16417 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:03.402382		NtOpenFile	file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.402382		NtCreateFile	create_disposition => 2 file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ create_options => 16417 status_info => 2 share_access => 3	SUCCESS
2016-11-03 00:17:03.402382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\AdhocWorkflow desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\AdhocWorkflow create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.402382		NtOpenFile	file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.402382		NtOpenFile	file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.402382		NtOpenFile	file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.402382		NtOpenFile	file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.402382		NtOpenFile	file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.402382		NtOpenFile	file_handle => 0x0000015c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.402382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\AdhocWorkflowBackup desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\AdhocWorkflowBackup create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.412382		LdrLoadDll	basename => ieframe module_address => 0x00000000 flags => 0 module_name => C:\WINDOWS\system32\ieframe.dll	FAILURE
2016-11-03 00:17:03.412382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.412382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.412382		LdrLoadDll	basename => EScript.api module_address => 0x23800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api	SUCCESS
2016-11-03 00:17:03.422382		LdrLoadDll	basename => ieframe module_address => 0x00000000 flags => 0 module_name => C:\WINDOWS\system32\ieframe.dll	FAILURE
2016-11-03 00:17:03.422382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.422382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.422382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.422382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.422382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.432382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.432382		NtCreateFile	create_disposition => 1 file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\JSByteCodeWin.bin desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\JSByteCodeWin.bin create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.442382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.442382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.442382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.442382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.442382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.442382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.442382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.442382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.442382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.442382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.442382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.442382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.452382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.452382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.452382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.452382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.452382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.452382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.452382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.452382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.452382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.452382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.452382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.452382		NtOpenFile	file_handle => 0x00000168 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.482382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.482382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.482382		LdrLoadDll	basename => DigSig.api module_address => 0x23000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api	SUCCESS
2016-11-03 00:17:03.492382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.492382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.492382		LdrLoadDll	basename => AXE8SharedExpat module_address => 0x10000000 flags => 0 module_name => AXE8SharedExpat.dll	SUCCESS
2016-11-03 00:17:03.492382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AXSLE.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AXSLE.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.492382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AXSLE.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AXSLE.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.492382		LdrLoadDll	basename => AXSLE module_address => 0x02cb0000 flags => 0 module_name => AXSLE.dll	SUCCESS
2016-11-03 00:17:03.502382		NtOpenFile	file_handle => 0x0000016c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.502382		NtCreateFile	create_disposition => 1 file_handle => 0x0000016c filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.502382		NtOpenFile	file_handle => 0x0000016c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.502382		NtCreateFile	create_disposition => 1 file_handle => 0x0000016c filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.502382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.502382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.512382		NtCreateFile	create_disposition => 1 file_handle => 0x00000170 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.sig desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.sig create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.512382		NtCreateFile	create_disposition => 1 file_handle => 0x00000170 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.512382		LdrLoadDll	basename => cryptocme2 module_address => 0x03cd0000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll	SUCCESS
2016-11-03 00:17:03.522382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.522382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.522382		LdrLoadDll	basename => ccme_base module_address => 0x03d80000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll	SUCCESS
2016-11-03 00:17:03.522382		LdrLoadDll	basename => cryptocme2 module_address => 0x03cd0000 flags => 0 module_name => .\cryptocme2.dll	SUCCESS
2016-11-03 00:17:03.522382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.sig desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.sig create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.522382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.522382		LdrLoadDll	basename => ccme_base module_address => 0x03d80000 flags => 0 module_name => .\ccme_base.dll	SUCCESS
2016-11-03 00:17:03.542382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\entropy desired_access => 0x80100080 file_attributes => 128 filepath_r => entropy create_options => 96 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:03.602382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ccme_ecc.dll desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ccme_ecc.dll create_options => 96 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:03.602382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ccme_eccaccel.dll desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ccme_eccaccel.dll create_options => 96 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:03.602382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.602382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.602382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.602382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.652382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.652382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.652382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.652382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.652382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.652382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.652382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.652382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.662382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.662382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.662382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.662382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.662382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.662382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.662382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.662382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.672382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.672382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.672382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.672382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.672382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.672382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.672382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.672382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.682382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.682382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.682382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.682382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.682382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.682382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.682382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.682382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.692382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.692382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.692382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.692382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.702382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.702382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.702382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.702382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.702382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.702382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.702382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.702382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.743382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.743382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.743382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.743382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.743382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.743382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.743382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.743382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.743382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.743382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.743382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.743382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.743382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.753382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.753382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.753382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.753382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.753382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.753382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.753382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.753382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.753382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.753382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.753382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.753382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.753382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.753382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.753382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.763382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.763382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.763382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.763382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.773382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.773382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.773382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.773382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.773382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.773382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.773382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.773382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.793382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.793382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.793382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.793382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.793382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.793382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.793382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.793382		LdrLoadDll	basename => AcroForm.api module_address => 0x20800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api	SUCCESS
2016-11-03 00:17:03.863382		LdrLoadDll	basename => AcroForm.api module_address => 0x20800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api	SUCCESS
2016-11-03 00:17:03.863382		LdrLoadDll	basename => AcroForm.api module_address => 0x20800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api	SUCCESS
2016-11-03 00:17:03.873382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.873382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.873382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.873382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.873382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.873382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.873382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.873382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.873382		LdrLoadDll	basename => DigSig.api module_address => 0x23000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api	SUCCESS
2016-11-03 00:17:03.873382		LdrLoadDll	basename => DigSig.api module_address => 0x23000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api	SUCCESS
2016-11-03 00:17:03.873382		LdrLoadDll	basename => DigSig.api module_address => 0x23000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api	SUCCESS
2016-11-03 00:17:03.873382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.873382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.873382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.873382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.883382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.883382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.883382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.883382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.883382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.883382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.883382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.883382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.883382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.883382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.883382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.883382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.883382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.883382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.883382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.883382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.883382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.883382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.883382		LdrLoadDll	basename => EScript.api module_address => 0x23800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api	SUCCESS
2016-11-03 00:17:03.883382		LdrLoadDll	basename => EScript.api module_address => 0x23800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api	SUCCESS
2016-11-03 00:17:03.893382		LdrLoadDll	basename => EScript.api module_address => 0x23800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api	SUCCESS
2016-11-03 00:17:03.893382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.893382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.893382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.893382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.893382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.893382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.893382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.893382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.893382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.893382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.893382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.893382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.893382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.893382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.903382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.903382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.903382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.903382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.903382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.903382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.903382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.903382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.903382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.903382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.903382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.903382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.903382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.903382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.903382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.913382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.913382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.913382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.913382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.913382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.913382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.923382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.923382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.923382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.923382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.923382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.923382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.923382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.923382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.923382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.923382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.923382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.923382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.923382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.923382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.923382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.923382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.923382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.923382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.923382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.923382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.923382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.923382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.923382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.923382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.923382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.933382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.933382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.933382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.933382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.933382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.933382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.933382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.933382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.933382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.933382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.933382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.933382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.933382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.933382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api open_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.933382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:03.933382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.933382		LdrLoadDll	basename => Annots.api module_address => 0x22100000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api	SUCCESS
2016-11-03 00:17:03.933382		LdrLoadDll	basename => Annots.api module_address => 0x22100000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api	SUCCESS
2016-11-03 00:17:03.933382		LdrLoadDll	basename => Annots.api module_address => 0x22100000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api	SUCCESS
2016-11-03 00:17:03.933382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.953382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.953382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.953382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.953382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.953382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.953382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.963382		LdrLoadDll	basename => PPKLite.api module_address => 0x28000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api	SUCCESS
2016-11-03 00:17:03.973382		NtOpenFile	file_handle => 0x00000178 filepath => C:\Documents and Settings\ardi\Local Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.973382		NtOpenFile	file_handle => 0x00000178 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.973382		CoInitializeEx	options => 2	FAILURE
2016-11-03 00:17:03.973382		CoUninitialize		SUCCESS
2016-11-03 00:17:03.973382		NtCreateFile	create_disposition => 5 file_handle => 0x00000178 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\A9R8012.tmp desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\A9R8012.tmp create_options => 96 status_info => 2 share_access => 0	SUCCESS
2016-11-03 00:17:03.973382		NtWriteFile	buffer => %PDF-1.6 %âãÏÓ 1 0 obj <</Pages 2 0 R/Type/Catalog>> endobj 2 0 obj <</Count 0/Kids[]/Type/Pages>> endobj 3 0 obj <<>> endobj xref 0 4 0000000000 65535 f 0000000016 00000 n 0000000061 00000 n 0000000107 00000 n trailer <</Size 4/Root 1 0 R/Info 3 0 R/ID[<256BC7AAB0BA214D9A92BA4EBC2386AA><256BC7AAB0BA214D9A92BA4EBC2386AA>]>> startxref 127 %%EOF file_handle => 0x00000178 offset => 0	SUCCESS
2016-11-03 00:17:03.973382		NtCreateFile	create_disposition => 1 file_handle => 0x00000178 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\A9R8012.tmp desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\A9R8012.tmp create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.973382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.973382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.973382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ open_options => 16417 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:03.973382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.973382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.983382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.983382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.983382		LdrLoadDll	basename => icuuc36 module_address => 0x00000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\icuuc36.dll	FAILURE
2016-11-03 00:17:03.983382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.983382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.983382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\icucnv36.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\icucnv36.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.983382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\icucnv36.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\icucnv36.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:03.983382		LdrLoadDll	basename => icucnv36 module_address => 0x4a800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\icucnv36.dll	SUCCESS
2016-11-03 00:17:03.983382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.983382		NtOpenFile	file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.983382		LdrLoadDll	basename => icudt36_cjk module_address => 0x00000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\icudt36_cjk.dll	FAILURE
2016-11-03 00:17:03.993382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.993382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.993382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.993382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:03.993382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:03.993382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.013382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.013382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.013382		NtOpenFile	file_handle => 0x00000174 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.013382		NtCreateFile	create_disposition => 1 file_handle => 0x00000174 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\pfm\SY______.PFM create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.013382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.013382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.013382		LdrLoadDll	basename => ATMLIB module_address => 0x73c20000 flags => 0 module_name => ATMLIB.dll	SUCCESS
2016-11-03 00:17:04.023382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.023382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.023382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.023382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.023382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.023382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.023382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.023382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.023382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.023382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.023382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.023382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.023382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.023382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.023382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.023382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.023382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.023382		NtOpenFile	file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.023382		NtCreateFile	create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.033382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.033382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.033382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.033382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.033382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.033382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.033382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.033382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.033382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.063382		LdrLoadDll	basename => mscms module_address => 0x73b30000 flags => 0 module_name => mscms.dll	SUCCESS
2016-11-03 00:17:04.063382		NtCreateFile	create_disposition => 1 file_handle => 0x00000190 filepath => C:\WINDOWS\system32\spool\drivers\color\sRGB Color Space Profile.icm desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\sRGB Color Space Profile.icm create_options => 2144 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.063382		NtCreateFile	create_disposition => 1 file_handle => 0x00000190 filepath => C:\WINDOWS\system32\spool\drivers\color\sRGB Color Space Profile.icm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\sRGB Color Space Profile.icm create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.073382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.073382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.073382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.073382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.073382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.073382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.073382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.073382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.073382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.073382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.073382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.073382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.073382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\Replicate\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\Replicate\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.073382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.073382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.073382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.073382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.083382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.083382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.083382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.083382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.083382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.083382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.083382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.083382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.083382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\Replicate\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\Replicate\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.113382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\rt3d.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\rt3d.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.113382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\rt3d.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\rt3d.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.113382		LdrLoadDll	basename => rt3d module_address => 0x03e10000 flags => 0 module_name => rt3d.dll	SUCCESS
2016-11-03 00:17:04.113382		NtOpenFile	file_handle => 0x00000190 filepath => C:\WINDOWS\system32 desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32 open_options => 33 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.113382		LdrLoadDll	basename => D3D8 module_address => 0x6d9a0000 flags => 0 module_name => D3D8.dll	SUCCESS
2016-11-03 00:17:04.123382		LdrLoadDll	basename => D3D9 module_address => 0x4fdd0000 flags => 0 module_name => D3D9.dll	SUCCESS
2016-11-03 00:17:04.123382		NtOpenFile	file_handle => 0x0000000c filepath => C:\Documents and Settings\ardi\Local Settings\Temp desired_access => 0x00100020 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Temp open_options => 33 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.123382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\language.englanguage.ln desired_access => 0x80100080 file_attributes => 0 filepath_r => language.englanguage.ln create_options => 96 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:04.123382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\$cache$.$p$ desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\$cache$.$p$ create_options => 96 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:04.123382		NtOpenFile	file_handle => 0x00000190 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.123382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\2d.x3d.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\2d.x3d.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.123382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\2d.x3d.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\2d.x3d.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.123382		LdrLoadDll	basename => 2d.x3d module_address => 0x03830000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\2d.x3d	SUCCESS
2016-11-03 00:17:04.133382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\language.eng2d.ln desired_access => 0x80100080 file_attributes => 0 filepath_r => language.eng2d.ln create_options => 96 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:04.133382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\3difr.x3d.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\3difr.x3d.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.133382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\3difr.x3d.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\3difr.x3d.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.133382		LdrLoadDll	basename => 3difr.x3d module_address => 0x038d0000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\3difr.x3d	SUCCESS
2016-11-03 00:17:04.133382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\language.eng3difr.ln desired_access => 0x80100080 file_attributes => 0 filepath_r => language.eng3difr.ln create_options => 96 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:04.143382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.143382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.143382		LdrLoadDll	basename => drvDX9.x3d module_address => 0x03960000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d	SUCCESS
2016-11-03 00:17:04.143382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\language.engdrvDX9.ln desired_access => 0x80100080 file_attributes => 0 filepath_r => language.engdrvDX9.ln create_options => 96 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:04.143382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.143382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.143382		LdrLoadDll	basename => drvSOFT.x3d module_address => 0x03af0000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d	SUCCESS
2016-11-03 00:17:04.143382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\language.engdrvSOFT.ln desired_access => 0x80100080 file_attributes => 0 filepath_r => language.engdrvSOFT.ln create_options => 96 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:04.153382		LdrLoadDll	basename => MSVFW32 module_address => 0x75a70000 flags => 0 module_name => MSVFW32.DLL	SUCCESS
2016-11-03 00:17:04.153382		LdrLoadDll	basename => DCIMAN32 module_address => 0x73bc0000 flags => 0 module_name => DCIMAN32.DLL	SUCCESS
2016-11-03 00:17:04.173382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.173382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.173382		LdrLoadDll	basename => prcr.x3d module_address => 0x04690000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d	SUCCESS
2016-11-03 00:17:04.173382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\language.engprcr.ln desired_access => 0x80100080 file_attributes => 0 filepath_r => language.engprcr.ln create_options => 96 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:04.173382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.173382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.173382		LdrLoadDll	basename => tesselate.x3d module_address => 0x03b20000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d	SUCCESS
2016-11-03 00:17:04.173382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\language.engtesselate.ln desired_access => 0x80100080 file_attributes => 0 filepath_r => language.engtesselate.ln create_options => 96 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:04.173382		NtOpenFile	file_handle => 0x000001b0 filepath => C:\WINDOWS\system32 desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32 open_options => 33 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.173382		LdrLoadDll	basename => d3d9 module_address => 0x4fdd0000 flags => 0 module_name => d3d9.dll	SUCCESS
2016-11-03 00:17:04.173382		NtOpenFile	file_handle => 0x000001bc filepath => C:\Documents and Settings\ardi\Local Settings\Temp desired_access => 0x00100020 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Temp open_options => 33 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.173382		NtCreateFile	create_disposition => 1 file_handle => 0x000001b0 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:04.183382		NtCreateFile	create_disposition => 1 file_handle => 0x000001c0 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:04.183382		NtCreateFile	create_disposition => 1 file_handle => 0x000001b0 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:04.183382		NtCreateFile	create_disposition => 1 file_handle => 0x000001c0 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:04.183382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\d3d9caps.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.dat create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.183382		LdrLoadDll	basename => SHELL32 module_address => 0x7c9c0000 flags => 0 module_name => SHELL32.DLL	SUCCESS
2016-11-03 00:17:04.183382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\d3d9caps.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\d3d9caps.dat create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.183382		NtCreateFile	create_disposition => 1 file_handle => 0x000001b0 filepath => C:\WINDOWS\Web\wallpaper\Bliss.bmp desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\web\wallpaper\Bliss.bmp create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.213382		NtCreateFile	create_disposition => 1 file_handle => 0x000001b0 filepath => C:\WINDOWS\Web\wallpaper\Bliss.bmp desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\web\wallpaper\Bliss.bmp create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.243382		NtCreateFile	create_disposition => 1 file_handle => 0x000001b0 filepath => C:\WINDOWS\Web\wallpaper\Bliss.bmp desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\web\wallpaper\Bliss.bmp create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.293382		NtCreateFile	create_disposition => 1 file_handle => 0x000001b0 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:04.293382		NtCreateFile	create_disposition => 1 file_handle => 0x000001c0 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:04.293382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\d3d9caps.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.dat create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.293382		LdrLoadDll	basename => SHELL32 module_address => 0x7c9c0000 flags => 0 module_name => SHELL32.DLL	SUCCESS
2016-11-03 00:17:04.293382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\d3d9caps.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\d3d9caps.dat create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.293382		NtCreateFile	create_disposition => 5 file_handle => 0x000001b0 filepath => C:\WINDOWS\system32\d3d9caps.dat desired_access => 0x40100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.dat create_options => 96 status_info => 2 share_access => 1	SUCCESS
2016-11-03 00:17:04.293382		NtWriteFile	buffer =>  file_handle => 0x000001b0 offset => 0	SUCCESS
2016-11-03 00:17:04.293382		NtWriteFile	buffer => î€ï¾| file_handle => 0x000001b0 offset => 0	SUCCESS
2016-11-03 00:17:04.293382		NtWriteFile	buffer => |ƒ0áèõ4Ò Ž·×¯ýÏC ¯ÂÈ5 ÿÿÿÿÿþÿÿÿ€? €à <`‚¤    file_handle => 0x000001b0 offset => 0	SUCCESS
2016-11-03 00:17:04.303382		NtCreateFile	create_disposition => 1 file_handle => 0x000001b0 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:04.303382		NtCreateFile	create_disposition => 1 file_handle => 0x000001c0 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:04.303382		NtCreateFile	create_disposition => 1 file_handle => 0x000001b0 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:04.303382		NtCreateFile	create_disposition => 1 file_handle => 0x000001c0 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:04.303382		NtCreateFile	create_disposition => 1 file_handle => 0x000001b0 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:04.303382		NtCreateFile	create_disposition => 1 file_handle => 0x000001c0 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:04.303382		NtCreateFile	create_disposition => 1 file_handle => 0x000001b0 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:04.303382		NtCreateFile	create_disposition => 1 file_handle => 0x000001c0 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:04.303382		CoInitializeEx	options => 2	FAILURE
2016-11-03 00:17:04.373382		CoCreateInstance	class_context => 4 clsid => {b22d0c7b-1e65-4533-97fa-a7335b8bcd94} iid => {8ca6c1bb-be62-4739-80ab-d5ecc7605358}	SUCCESS
2016-11-03 00:17:04.373382		LdrLoadDll	basename => OLEAUT32 module_address => 0x77120000 flags => 0 module_name => OLEAUT32	SUCCESS
2016-11-03 00:17:04.373382		NtCreateFile	create_disposition => 1 file_handle => 0x00000268 filepath => \\?\PIPE\lsarpc desired_access => 0xc0100080 file_attributes => 0 filepath_r => \??\PIPE\lsarpc create_options => 64 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.373382		NtWriteFile	buffer => H ¸¸ xW44Í«ï #Eg‰«]ˆŠëÉŸè+H` file_handle => 0x00000268 offset => 0	SUCCESS
2016-11-03 00:17:04.373382		NtOpenFile	file_handle => 0x0000026c filepath => C:\WINDOWS\system32 desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32 open_options => 33 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.373382		LdrLoadDll	basename => D3D9 module_address => 0x4fdd0000 flags => 0 module_name => D3D9.dll	SUCCESS
2016-11-03 00:17:04.373382		NtOpenFile	file_handle => 0x000001bc filepath => C:\Documents and Settings\ardi\Local Settings\Temp desired_access => 0x00100020 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Temp open_options => 33 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.373382		NtCreateFile	create_disposition => 1 file_handle => 0x0000026c filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:04.373382		NtCreateFile	create_disposition => 1 file_handle => 0x00000270 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:04.373382		NtCreateFile	create_disposition => 1 file_handle => 0x0000026c filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:04.373382		NtCreateFile	create_disposition => 1 file_handle => 0x00000270 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:04.373382		NtCreateFile	create_disposition => 1 file_handle => 0x0000026c filepath => C:\WINDOWS\system32\d3d9caps.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.dat create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.373382		NtCreateFile	create_disposition => 1 file_handle => 0x0000026c filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:04.373382		NtCreateFile	create_disposition => 1 file_handle => 0x00000270 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:04.373382		NtCreateFile	create_disposition => 1 file_handle => 0x0000026c filepath => C:\WINDOWS\system32\d3d9caps.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.dat create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.373382		NtCreateFile	create_disposition => 1 file_handle => 0x0000026c filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:04.373382		NtCreateFile	create_disposition => 1 file_handle => 0x00000270 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5	SUCCESS
2016-11-03 00:17:04.373382		NtCreateFile	create_disposition => 1 file_handle => 0x0000026c filepath => C:\WINDOWS\system32\d3d9caps.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.dat create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.373382		NtCreateFile	create_disposition => 5 file_handle => 0x00000270 filepath => C:\WINDOWS\system32\d3d9caps.tmp desired_access => 0x40100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.tmp create_options => 96 status_info => 2 share_access => 1	SUCCESS
2016-11-03 00:17:04.373382		NtWriteFile	buffer =>  file_handle => 0x00000270 offset => 0	SUCCESS
2016-11-03 00:17:04.373382		NtWriteFile	buffer => î€ï¾| file_handle => 0x00000270 offset => 0	SUCCESS
2016-11-03 00:17:04.373382		NtWriteFile	buffer => |ƒ0áèõ4Ò Ž·×¯ýÏC ¯ÂÈ5 ÿÿÿÿÿþÿÿÿ€? P <ð ¤    file_handle => 0x00000270 offset => 0	SUCCESS
2016-11-03 00:17:04.373382		NtOpenFile	file_handle => 0x0000026c filepath => C:\WINDOWS\system32\d3d9caps.dat desired_access => 0x00010080 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.dat open_options => 2113600 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:04.373382		NtOpenFile	file_handle => 0x0000026c filepath => C:\WINDOWS\system32\d3d9caps.tmp desired_access => 0x00110080 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.tmp open_options => 2113568 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:04.383382		LdrLoadDll	basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32.dll	SUCCESS
2016-11-03 00:17:04.383382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.383382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.393382		NtOpenFile	file_handle => 0x00000278 filepath => C:\WINDOWS\system32\urlmon.dll desired_access => 0x001200a9 filepath_r => \??\C:\WINDOWS\system32\urlmon.dll open_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.393382		NtOpenFile	file_handle => 0x00000000 filepath => C:\WINDOWS\system32\urlmon.dll.123.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\WINDOWS\system32\urlmon.dll.123.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.393382		NtOpenFile	file_handle => 0x00000000 filepath => C:\WINDOWS\system32\urlmon.dll.123.Config desired_access => 0x001200a9 filepath_r => \??\C:\WINDOWS\system32\urlmon.dll.123.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.393382		LdrLoadDll	basename => comctl32 module_address => 0x773d0000 flags => 0 module_name => comctl32.dll	SUCCESS
2016-11-03 00:17:04.393382		LdrLoadDll	basename => DSOUND module_address => 0x73f10000 flags => 0 module_name => C:\WINDOWS\system32\DSOUND.dll	SUCCESS
2016-11-03 00:17:04.414382		LdrLoadDll	basename => dbghelp module_address => 0x59a60000 flags => 0 module_name => dbghelp.dll	SUCCESS
2016-11-03 00:17:04.414382		LdrLoadDll	basename => authplay module_address => 0x30000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll	SUCCESS
2016-11-03 00:17:04.414382		CoInitializeEx	options => 2	FAILURE
2016-11-03 00:17:04.424382		CoCreateInstance	class_context => 3 clsid => {275c23e2-3747-11d0-9fea-00aa003f8646} iid => {275c23e1-3747-11d0-9fea-00aa003f8646}	SUCCESS
2016-11-03 00:17:04.424382		LdrLoadDll	basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32.dll	SUCCESS
2016-11-03 00:17:04.424382		LdrLoadDll	basename => user32 module_address => 0x7e410000 flags => 0 module_name => user32.dll	SUCCESS
2016-11-03 00:17:04.424382		LdrLoadDll	basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll	SUCCESS
2016-11-03 00:17:04.424382		LdrLoadDll	basename => version module_address => 0x77c00000 flags => 0 module_name => version.dll	SUCCESS
2016-11-03 00:17:04.424382		NtOpenFile	file_handle => 0x00000234 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.424382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Macromed\Flash\ss.sgn desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\ss.sgn create_options => 96 status_info => 4294967295 share_access => 7	FAILURE
2016-11-03 00:17:04.424382		NtOpenFile	file_handle => 0x00000234 filepath => C:\WINDOWS\system32\Macromed\Flash\ desired_access => 0x00100001 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.424382		NtOpenFile	file_handle => 0x00000234 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.424382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Macromed\Flash\ss.cfg desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\ss.cfg create_options => 96 status_info => 4294967295 share_access => 7	FAILURE
2016-11-03 00:17:04.424382		NtOpenFile	file_handle => 0x00000234 filepath => C:\WINDOWS\system32\Macromed\Flash\ desired_access => 0x00100001 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.424382		NtOpenFile	file_handle => 0x00000234 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.424382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Macromed\Flash\ss.sgn desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\ss.sgn create_options => 96 status_info => 4294967295 share_access => 7	FAILURE
2016-11-03 00:17:04.424382		NtOpenFile	file_handle => 0x00000234 filepath => C:\WINDOWS\system32\Macromed\Flash\ desired_access => 0x00100001 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.424382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Macromed\Flash\mms.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\mms.cfg create_options => 100 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.424382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Macromed\Flash\mms.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\mms.cfg create_options => 100 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:04.424382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\mms.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\mms.cfg create_options => 100 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.424382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\mms.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\mms.cfg create_options => 100 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:04.424382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Macromed\Flash\oem.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\oem.cfg create_options => 100 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.424382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Macromed\Flash\oem.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\oem.cfg create_options => 100 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:04.424382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\oem.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\oem.cfg create_options => 100 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.424382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\oem.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\oem.cfg create_options => 100 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:04.424382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\mm.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\mm.cfg create_options => 100 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.424382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\mm.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\mm.cfg create_options => 100 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:04.424382		LdrLoadDll	basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32.dll	SUCCESS
2016-11-03 00:17:04.424382		LdrLoadDll	basename => user32 module_address => 0x7e410000 flags => 0 module_name => user32.dll	SUCCESS
2016-11-03 00:17:04.424382		LdrLoadDll	basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll	SUCCESS
2016-11-03 00:17:04.424382		LdrLoadDll	basename => version module_address => 0x77c00000 flags => 0 module_name => version.dll	SUCCESS
2016-11-03 00:17:04.434382		LdrLoadDll	basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32.dll	SUCCESS
2016-11-03 00:17:04.434382		LdrLoadDll	basename => user32 module_address => 0x7e410000 flags => 0 module_name => user32.dll	SUCCESS
2016-11-03 00:17:04.434382		LdrLoadDll	basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll	SUCCESS
2016-11-03 00:17:04.434382		LdrLoadDll	basename => version module_address => 0x77c00000 flags => 0 module_name => version.dll	SUCCESS
2016-11-03 00:17:04.444382		NtOpenFile	file_handle => 0x00000290 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.444382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache create_options => 96 status_info => 4294967295 share_access => 7	FAILURE
2016-11-03 00:17:04.444382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\ open_options => 16417 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:04.444382		NtOpenFile	file_handle => 0x00000290 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.444382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player create_options => 96 status_info => 4294967295 share_access => 7	FAILURE
2016-11-03 00:17:04.444382		NtOpenFile	file_handle => 0x00000290 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.444382		NtOpenFile	file_handle => 0x00000290 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.444382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe create_options => 96 status_info => 4294967295 share_access => 7	FAILURE
2016-11-03 00:17:04.444382		NtOpenFile	file_handle => 0x00000290 filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.444382		NtCreateFile	create_disposition => 2 file_handle => 0x00000290 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player create_options => 16417 status_info => 2 share_access => 3	SUCCESS
2016-11-03 00:17:04.444382		NtOpenFile	file_handle => 0x00000290 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.444382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player create_options => 96 status_info => 4294967295 share_access => 7	FAILURE
2016-11-03 00:17:04.444382		NtOpenFile	file_handle => 0x00000290 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.444382		NtCreateFile	create_disposition => 2 file_handle => 0x00000290 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache create_options => 16417 status_info => 2 share_access => 3	SUCCESS
2016-11-03 00:17:04.444382		NtOpenFile	file_handle => 0x00000290 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.444382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache create_options => 96 status_info => 4294967295 share_access => 7	FAILURE
2016-11-03 00:17:04.444382		NtOpenFile	file_handle => 0x00000290 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.444382		NtOpenFile	file_handle => 0x00000290 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.444382		LdrLoadDll	basename => advapi32 module_address => 0x77dd0000 flags => 0 module_name => advapi32.dll	SUCCESS
2016-11-03 00:17:04.444382		NtCreateFile	create_disposition => 1 file_handle => 0x00000294 filepath => C:\WINDOWS\system32\rsaenh.dll desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\rsaenh.dll create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.444382		NtCreateFile	create_disposition => 1 file_handle => 0x00000294 filepath => C:\WINDOWS\system32\rsaenh.dll desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\rsaenh.dll create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.454382		LdrLoadDll	basename => crypt32 module_address => 0x77a80000 flags => 0 module_name => crypt32.dll	SUCCESS
2016-11-03 00:17:04.454382		NtCreateFile	create_disposition => 1 file_handle => 0x00000298 filepath => C:\WINDOWS\system32\rsaenh.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\rsaenh.dll create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.454382		NtCreateFile	create_disposition => 1 file_handle => 0x00000298 filepath => C:\WINDOWS\system32\rsaenh.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\rsaenh.dll create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.474382		LdrLoadDll	basename => rsaenh module_address => 0x68000000 flags => 0 module_name => rsaenh.dll	SUCCESS
2016-11-03 00:17:04.474382		NtOpenFile	file_handle => 0x00000290 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.474382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ESEYZNKA desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ESEYZNKA create_options => 96 status_info => 4294967295 share_access => 7	FAILURE
2016-11-03 00:17:04.474382		NtOpenFile	file_handle => 0x00000290 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.474382		NtOpenFile	file_handle => 0x00000290 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.474382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache create_options => 96 status_info => 4294967295 share_access => 7	FAILURE
2016-11-03 00:17:04.474382		NtOpenFile	file_handle => 0x00000290 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.474382		NtCreateFile	create_disposition => 2 file_handle => 0x00000290 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ESEYZNKA desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ESEYZNKA create_options => 16417 status_info => 2 share_access => 3	SUCCESS
2016-11-03 00:17:04.474382		NtOpenFile	file_handle => 0x00000290 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.474382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ESEYZNKA desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ESEYZNKA create_options => 96 status_info => 4294967295 share_access => 7	FAILURE
2016-11-03 00:17:04.474382		NtOpenFile	file_handle => 0x00000290 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.494382		LdrLoadDll	basename => WINMM module_address => 0x76b40000 flags => 0 module_name => C:\WINDOWS\system32\WINMM.dll	SUCCESS
2016-11-03 00:17:04.694382		CoInitializeEx	options => 2	FAILURE
2016-11-03 00:17:04.694382		CoUninitialize		SUCCESS
2016-11-03 00:17:04.694382		CoInitializeEx	options => 2	FAILURE
2016-11-03 00:17:04.694382		CoUninitialize		SUCCESS
2016-11-03 00:17:04.694382		CoInitializeEx	options => 2	FAILURE
2016-11-03 00:17:04.694382		CoUninitialize		SUCCESS
2016-11-03 00:17:04.694382		LdrLoadDll	basename => OLEAUT32 module_address => 0x77120000 flags => 0 module_name => OLEAUT32.dll	SUCCESS
2016-11-03 00:17:04.694382		NtOpenFile	file_handle => 0x000002c4 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.694382		NtOpenFile	file_handle => 0x000002c4 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.694382		NtOpenFile	file_handle => 0x000002c4 filepath => C:\Documents and Settings\ardi\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ardi\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.694382		NtOpenFile	file_handle => 0x000002c4 filepath => C:\Documents and Settings\ardi\Local Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.694382		NtOpenFile	file_handle => 0x000002c8 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.694382		NtOpenFile	file_handle => 0x000002c8 filepath => C:\Documents and Settings\ardi\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.694382		NtOpenFile	file_handle => 0x000002c8 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Temp\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.704382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.704382		NtCreateFile	create_disposition => 1 file_handle => 0x000002e8 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.704382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.704382		NtCreateFile	create_disposition => 1 file_handle => 0x000002e8 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.704382		LdrLoadDll	basename => wdmaud.drv module_address => 0x72d20000 flags => 0 module_name => wdmaud.drv	SUCCESS
2016-11-03 00:17:04.704382		LdrLoadDll	basename => setupapi module_address => 0x77920000 flags => 0 module_name => setupapi.dll	SUCCESS
2016-11-03 00:17:04.704382		LdrLoadDll	basename => WINTRUST module_address => 0x76c30000 flags => 0 module_name => WINTRUST.dll	SUCCESS
2016-11-03 00:17:04.704382		NtCreateFile	create_disposition => 1 file_handle => 0x000002ec filepath => \\?\root#system#0000#{3e227e76-690d-11d2-8161-0000f8775bf1}\{cd171de3-69e5-11d2-b56d-0000f8754380}&{9b365890-165f-11d0-a195-0020afd156e4} desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\root#system#0000#{3e227e76-690d-11d2-8161-0000f8775bf1}\{cd171de3-69e5-11d2-b56d-0000f8754380}&{9b365890-165f-11d0-a195-0020afd156e4} create_options => 64 status_info => 0 share_access => 0	SUCCESS
2016-11-03 00:17:04.704382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.704382		NtCreateFile	create_disposition => 1 file_handle => 0x000002e0 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.704382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.704382		NtCreateFile	create_disposition => 1 file_handle => 0x000002e0 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.704382		LdrLoadDll	basename => wdmaud.drv module_address => 0x72d20000 flags => 0 module_name => wdmaud.drv	SUCCESS
2016-11-03 00:17:04.704382		LdrLoadDll	basename => setupapi module_address => 0x77920000 flags => 0 module_name => setupapi.dll	SUCCESS
2016-11-03 00:17:04.704382		NtCreateFile	create_disposition => 1 file_handle => 0x000002e4 filepath => \\?\root#system#0000#{3e227e76-690d-11d2-8161-0000f8775bf1}\{cd171de3-69e5-11d2-b56d-0000f8754380}&{9b365890-165f-11d0-a195-0020afd156e4} desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\root#system#0000#{3e227e76-690d-11d2-8161-0000f8775bf1}\{cd171de3-69e5-11d2-b56d-0000f8754380}&{9b365890-165f-11d0-a195-0020afd156e4} create_options => 64 status_info => 0 share_access => 0	SUCCESS
2016-11-03 00:17:04.714382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.714382		NtCreateFile	create_disposition => 1 file_handle => 0x00000310 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.714382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.714382		NtCreateFile	create_disposition => 1 file_handle => 0x00000310 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.714382		LdrLoadDll	basename => wdmaud.drv module_address => 0x72d20000 flags => 0 module_name => wdmaud.drv	SUCCESS
2016-11-03 00:17:04.714382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.714382		NtCreateFile	create_disposition => 1 file_handle => 0x00000310 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.714382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.714382		NtCreateFile	create_disposition => 1 file_handle => 0x00000310 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.714382		LdrLoadDll	basename => wdmaud.drv module_address => 0x72d20000 flags => 0 module_name => wdmaud.drv	SUCCESS
2016-11-03 00:17:04.714382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.714382		NtCreateFile	create_disposition => 1 file_handle => 0x00000310 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.714382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.714382		NtCreateFile	create_disposition => 1 file_handle => 0x00000310 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.714382		LdrLoadDll	basename => wdmaud.drv module_address => 0x72d20000 flags => 0 module_name => wdmaud.drv	SUCCESS
2016-11-03 00:17:04.714382		LdrLoadDll	basename => msacm32.drv module_address => 0x72d10000 flags => 0 module_name => msacm32.drv	SUCCESS
2016-11-03 00:17:04.724382		LdrLoadDll	basename => msacm32.drv module_address => 0x72d10000 flags => 0 module_name => msacm32.drv	SUCCESS
2016-11-03 00:17:04.724382		LdrLoadDll	basename => msacm32.drv module_address => 0x72d10000 flags => 0 module_name => msacm32.drv	SUCCESS
2016-11-03 00:17:04.724382		LdrLoadDll	basename => msacm32.drv module_address => 0x72d10000 flags => 0 module_name => msacm32.drv	SUCCESS
2016-11-03 00:17:04.724382		LdrLoadDll	basename => msacm32.drv module_address => 0x72d10000 flags => 0 module_name => msacm32.drv	SUCCESS
2016-11-03 00:17:04.724382		LdrLoadDll	basename => msacm32.drv module_address => 0x72d10000 flags => 0 module_name => msacm32.drv	SUCCESS
2016-11-03 00:17:04.724382		LdrLoadDll	basename => midimap module_address => 0x77bd0000 flags => 0 module_name => midimap.dll	SUCCESS
2016-11-03 00:17:04.724382		LdrLoadDll	basename => midimap module_address => 0x77bd0000 flags => 0 module_name => midimap.dll	SUCCESS
2016-11-03 00:17:04.724382		LdrLoadDll	basename => midimap module_address => 0x77bd0000 flags => 0 module_name => midimap.dll	SUCCESS
2016-11-03 00:17:04.724382		LdrLoadDll	basename => midimap module_address => 0x77bd0000 flags => 0 module_name => midimap.dll	SUCCESS
2016-11-03 00:17:04.724382		LdrLoadDll	basename => Secur32 module_address => 0x77fe0000 flags => 0 module_name => Secur32.dll	SUCCESS
2016-11-03 00:17:04.724382		LdrLoadDll	basename => crypt32 module_address => 0x77a80000 flags => 0 module_name => crypt32.dll	SUCCESS
2016-11-03 00:17:04.724382		NtOpenFile	file_handle => 0x00000328 filepath => C:\WINDOWS\system32 desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32 open_options => 33 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.724382		LdrLoadDll	basename => schannel module_address => 0x767f0000 flags => 0 module_name => C:\WINDOWS\system32\schannel.dll	SUCCESS
2016-11-03 00:17:04.724382		NtOpenFile	file_handle => 0x0000036c filepath => C:\Documents and Settings\ardi\Local Settings\Temp desired_access => 0x00100020 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Temp open_options => 33 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.744382		NtOpenFile	file_handle => 0x0000037c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.744382		NtCreateFile	create_disposition => 1 file_handle => 0x00000380 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.744382		NtCreateFile	create_disposition => 1 file_handle => 0x00000380 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.754382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.754382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.764382		LdrLoadDll	basename => Updater.api module_address => 0x30800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api	SUCCESS
2016-11-03 00:17:04.764382		NtCreateFile	create_disposition => 1 file_handle => 0x0000037c filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Acrobat\9.0\Updater\updater.log desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Acrobat\9.0\Updater\updater.log create_options => 2144 status_info => 1 share_access => 0	SUCCESS
2016-11-03 00:17:04.764382		NtCreateFile	create_disposition => 1 file_handle => 0x0000037c filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Acrobat\9.0\Updater\updater.log desired_access => 0x40100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Acrobat\9.0\Updater\updater.log create_options => 2144 status_info => 1 share_access => 0	SUCCESS
2016-11-03 00:17:04.764382		NtWriteFile	buffer => : Loading AUM Integration library at path C:\Program Files\Adobe\Reader 9.0\Reader\AdobeUpdater.dll. file_handle => 0x0000037c offset => 0	SUCCESS
2016-11-03 00:17:04.764382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AdobeUpdater.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AdobeUpdater.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.764382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AdobeUpdater.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AdobeUpdater.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.764382		LdrLoadDll	basename => AdobeUpdater module_address => 0x0ff60000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\AdobeUpdater.dll	SUCCESS
2016-11-03 00:17:04.764382		NtWriteFile	buffer => : Successfully loaded AUM integration library file_handle => 0x0000037c offset => 0	SUCCESS
2016-11-03 00:17:04.764382		NtWriteFile	buffer => : Successfully found all library entry points. Library is valid. file_handle => 0x0000037c offset => 0	SUCCESS
2016-11-03 00:17:04.764382		NtWriteFile	buffer => : Entering GetAppID() file_handle => 0x0000037c offset => 0	SUCCESS
2016-11-03 00:17:04.774382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\AdobeUpdaterPrefs.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\AdobeUpdaterPrefs.dat create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.774382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\AdobeUpdaterPrefs.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\AdobeUpdaterPrefs.dat create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.774382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\AdobeUpdaterPrefs.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\AdobeUpdaterPrefs.dat create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.774382		NtCreateFile	create_disposition => 1 file_handle => 0x0000039c filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\aumLib.log desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\aumLib.log create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.774382		CoInitializeEx	options => 6	FAILURE
2016-11-03 00:17:04.774382		NtOpenFile	file_handle => 0x000003a4 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.774382		NtOpenFile	file_handle => 0x000003a4 filepath => C:\WINDOWS\ desired_access => 0x00100001 filepath_r => \??\C:\WINDOWS\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.774382		CoUninitialize		SUCCESS
2016-11-03 00:17:04.774382		LdrLoadDll	basename => Kernel32 module_address => 0x7c800000 flags => 0 module_name => C:\WINDOWS\system32\Kernel32.dll	SUCCESS
2016-11-03 00:17:04.774382		NtCreateFile	create_disposition => 3 file_handle => 0x0000039c filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\aumLib.log desired_access => 0x40100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\aumLib.log create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.774382		NtWriteFile	buffer => 2016-11-02T17:17:04: >>> Adobe Updater Log Begin >>> file_handle => 0x0000039c offset => 0	SUCCESS
2016-11-03 00:17:04.774382		NtWriteFile	buffer => 2016-11-02T17:17:04: logFile: = C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\aumLib.log file_handle => 0x0000039c offset => 0	SUCCESS
2016-11-03 00:17:04.774382		NtWriteFile	buffer => 2016-11-02T17:17:04: logLevel: = 2 file_handle => 0x0000039c offset => 0	SUCCESS
2016-11-03 00:17:04.774382		NtWriteFile	buffer => 2016-11-02T17:17:04: Vista IE Protected Mode:No file_handle => 0x0000039c offset => 0	SUCCESS
2016-11-03 00:17:04.774382		NtWriteFile	buffer => 2016-11-02T17:17:04: In AUMDownloadMissingComponents(...) file_handle => 0x0000039c offset => 0	SUCCESS
2016-11-03 00:17:04.774382		NtWriteFile	buffer => 2016-11-02T17:17:04: appIdentifierreader9rdr-en_US file_handle => 0x0000039c offset => 0	SUCCESS
2016-11-03 00:17:04.774382		NtWriteFile	buffer => 2016-11-02T17:17:04: appFolderPathC:\Program Files\Adobe\Reader 9.0\Reader file_handle => 0x0000039c offset => 0	SUCCESS
2016-11-03 00:17:04.774382		NtWriteFile	buffer => 2016-11-02T17:17:04: appDisplayNameAdobe Reader 9 file_handle => 0x0000039c offset => 0	SUCCESS
2016-11-03 00:17:04.774382		NtWriteFile	buffer => 2016-11-02T17:17:04: appDisplayLangen_US file_handle => 0x0000039c offset => 0	SUCCESS
2016-11-03 00:17:04.774382		NtWriteFile	buffer => 2016-11-02T17:17:04: bOverrideData= true file_handle => 0x0000039c offset => 0	SUCCESS
2016-11-03 00:17:04.774382		NtWriteFile	buffer => 2016-11-02T17:17:04: Has admin priv. file_handle => 0x0000039c offset => 0	SUCCESS
2016-11-03 00:17:04.774382		CoInitializeEx	options => 6	FAILURE
2016-11-03 00:17:04.774382		NtOpenFile	file_handle => 0x000003a0 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.774382		NtOpenFile	file_handle => 0x000003a0 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.774382		NtOpenFile	file_handle => 0x000003a0 filepath => C:\Documents and Settings\All Users\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\All Users\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.774382		NtOpenFile	file_handle => 0x000003a0 filepath => C:\Documents and Settings\All Users\Application Data\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\All Users\Application Data\desktop.ini open_options => 96 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:04.774382		NtOpenFile	file_handle => 0x000003a0 filepath => C:\Documents and Settings\All Users\Application Data\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\All Users\Application Data\desktop.ini open_options => 96 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:04.774382		NtOpenFile	file_handle => 0x000003a0 filepath => C:\Documents and Settings\All Users\Application Data\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\All Users\Application Data\desktop.ini open_options => 96 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:04.774382		CoUninitialize		SUCCESS
2016-11-03 00:17:04.774382		LdrLoadDll	basename => NTMARTA module_address => 0x77690000 flags => 0 module_name => NTMARTA.DLL	SUCCESS
2016-11-03 00:17:04.774382		NtOpenFile	file_handle => 0x000003d4 filepath => C:\Documents and Settings\All Users\Application Data\Adobe\Updater6 desired_access => 0x00060080 filepath_r => \??\C:\Documents and Settings\All Users\Application Data\Adobe\Updater6 open_options => 2097152 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:04.774382		NtOpenFile	file_handle => 0x000003dc filepath => C:\Documents and Settings\All Users\Application Data\Adobe\ desired_access => 0x00020000 filepath_r => \Device\HarddiskVolume1\Documents and Settings\All Users\Application Data\Adobe\ open_options => 2097152 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:04.784382		NtOpenFile	file_handle => 0x000003dc filepath => C:\Documents and Settings\All Users\Application Data\Adobe\Updater6 desired_access => 0x00100001 filepath_r => open_options => 2113569 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.784382		NtOpenFile	file_handle => 0x000003e0 filepath => C:\Documents and Settings\All Users\Application Data\Adobe\Updater6\AdobeESDGlobalApps.xml desired_access => 0x00060080 filepath_r => AdobeESDGlobalApps.xml open_options => 2097152 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:04.784382		NtOpenFile	file_handle => 0x000003d4 filepath => C:\Documents and Settings\All Users\Application Data\Adobe\Updater6\AdobeESDGlobalApps.xml desired_access => 0x00060080 filepath_r => \??\C:\Documents and Settings\All Users\Application Data\Adobe\Updater6\AdobeESDGlobalApps.xml open_options => 2097152 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:04.784382		NtOpenFile	file_handle => 0x000003e0 filepath => C:\Documents and Settings\All Users\Application Data\Adobe\Updater6\ desired_access => 0x00020000 filepath_r => \Device\HarddiskVolume1\Documents and Settings\All Users\Application Data\Adobe\Updater6\ open_options => 2097152 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:04.784382		NtCreateFile	create_disposition => 1 file_handle => 0x000003e0 filepath => C:\Documents and Settings\All Users\Application Data\Adobe\Updater6\AdobeESDGlobalApps.xml desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\All Users\Application Data\Adobe\Updater6\AdobeESDGlobalApps.xml create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.784382		NtCreateFile	create_disposition => 5 file_handle => 0x000003e0 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\AdobeMissingComps.xml_ desired_access => 0x40100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\AdobeMissingComps.xml_ create_options => 96 status_info => 2 share_access => 1	SUCCESS
2016-11-03 00:17:04.784382		NtWriteFile	buffer => <?xml version="1.0" encoding="UTF-8" ?> file_handle => 0x000003e0 offset => 0	SUCCESS
2016-11-03 00:17:04.784382		NtWriteFile	buffer => <AdobeUpdaterMissingCompsManager> file_handle => 0x000003e0 offset => 0	SUCCESS
2016-11-03 00:17:04.784382		NtWriteFile	buffer => <AdobeUpdaterMissingCompsApp AppID="reader9rdr-en_US" OperationType="1" RedoCFU="1"> file_handle => 0x000003e0 offset => 0	SUCCESS
2016-11-03 00:17:04.784382		NtWriteFile	buffer => <DisplayName>Adobe Reader 9</DisplayName> file_handle => 0x000003e0 offset => 0	SUCCESS
2016-11-03 00:17:04.784382		NtWriteFile	buffer => <InstallPath>C:\Program Files\Adobe\Reader 9.0\Reader</InstallPath> file_handle => 0x000003e0 offset => 0	SUCCESS
2016-11-03 00:17:04.784382		NtWriteFile	buffer => <AMissingComponent category="LangPkg" name="SChn" version="0.0.0.0"></AMissingComponent> file_handle => 0x000003e0 offset => 0	SUCCESS
2016-11-03 00:17:04.784382		NtWriteFile	buffer => </AdobeUpdaterMissingCompsApp> file_handle => 0x000003e0 offset => 0	SUCCESS
2016-11-03 00:17:04.784382		NtWriteFile	buffer => </AdobeUpdaterMissingCompsManager> file_handle => 0x000003e0 offset => 0	SUCCESS
2016-11-03 00:17:04.784382		NtCreateFile	create_disposition => 1 file_handle => 0x000003e0 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\AdobeMissingComps.xml_ desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\AdobeMissingComps.xml_ create_options => 2097252 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.784382		NtCreateFile	create_disposition => 2 file_handle => 0x000003dc filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\AdobeMissingComps.xml desired_access => 0x40110080 file_attributes => 32 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\AdobeMissingComps.xml create_options => 100 status_info => 2 share_access => 0	SUCCESS
2016-11-03 00:17:04.784382		NtWriteFile	buffer => <?xml version="1.0" encoding="UTF-8" ?> <AdobeUpdaterMissingCompsManager> <AdobeUpdaterMissingCompsApp AppID="reader9rdr-en_US" OperationType="1" RedoCFU="1"> <DisplayName>Adobe Reader 9</DisplayName> <InstallPath>C:\Program Files\Adobe\Reader 9.0\Reader</InstallPath> <AMissingComponent category="LangPkg" name="SChn" version="0.0.0.0"></AMissingComponent> </AdobeUpdaterMissingCompsApp> </AdobeUpdaterMissingCompsManager> file_handle => 0x000003dc offset => 0	SUCCESS
2016-11-03 00:17:04.784382		NtOpenFile	file_handle => 0x000003dc filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\AdobeMissingComps.xml_ desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\AdobeMissingComps.xml_ open_options => 2113600 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:04.784382		NtOpenFile	file_handle => 0x000003dc filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\AdobeMissingComps.xml desired_access => 0x00060080 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\AdobeMissingComps.xml open_options => 2097152 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:04.784382		NtWriteFile	buffer => 2016-11-02T17:17:04: MissingMedia Path = C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\AdobeMissingComps.xml file_handle => 0x0000039c offset => 0	SUCCESS
2016-11-03 00:17:04.794382		NtOpenFile	file_handle => 0x000003dc filepath => C:\Program Files\Common Files\Adobe\Updater6\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\Updater6\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.794382		LdrLoadDll	basename => PSAPI module_address => 0x76bf0000 flags => 0 module_name => C:\WINDOWS\system32\PSAPI.DLL	SUCCESS
2016-11-03 00:17:04.794382		NtWriteFile	buffer => 2016-11-02T17:17:04: Launching AUM. file_handle => 0x0000039c offset => 0	SUCCESS
2016-11-03 00:17:04.834382		CreateProcessInternalW	thread_identifier => 1576 thread_handle => 0x000003f0 process_identifier => 1340 current_directory => C:\Program Files\Common Files\Adobe\Updater6 filepath => track => 1 command_line => "C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe" -AU_LAUNCH_MODE=3 -AU_DISPLAY_LANG=en_US filepath_r => creation_flags => 134218752 process_handle => 0x000003ec inherit_handles => 0	SUCCESS
2016-11-03 00:17:04.834382		NtCreateFile	create_disposition => 1 file_handle => 0x000003f0 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\AdobeMissingComps.xml desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Updater6\AdobeMissingComps.xml create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:04.834382		NtWriteFile	buffer => : AUMDownloadMissingComponents returns => 0 file_handle => 0x0000037c offset => 0	SUCCESS
2016-11-03 00:17:04.854382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\BIBUtils.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\BIBUtils.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.854382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\BIBUtils.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\BIBUtils.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:04.854382		LdrLoadDll	basename => BIBUtils module_address => 0x06fa0000 flags => 0 module_name => BIBUtils.dll	SUCCESS
2016-11-03 00:17:04.854382		NtOpenFile	file_handle => 0x00000370 filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.854382		NtOpenFile	file_handle => 0x00000370 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.854382		NtOpenFile	file_handle => 0x00000370 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.864382		NtOpenFile	file_handle => 0x00000370 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.864382		NtOpenFile	file_handle => 0x00000370 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.864382		NtOpenFile	file_handle => 0x00000370 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:04.864382		NtCreateFile	create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\AdhocWorkflowBackup desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\AdhocWorkflowBackup create_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:06.857382		NtOpenFile	file_handle => 0x000003f0 filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.857382		NtOpenFile	file_handle => 0x000003f0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.857382		NtOpenFile	file_handle => 0x000003f0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.857382		NtOpenFile	file_handle => 0x000003f0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.857382		NtOpenFile	file_handle => 0x000003f0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.857382		NtOpenFile	file_handle => 0x000003f0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.857382		NtOpenFile	file_handle => 0x000003f0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.857382		NtOpenFile	file_handle => 0x000003f0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.857382		NtOpenFile	file_handle => 0x000003f0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.857382		NtOpenFile	file_handle => 0x000003f0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.867382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\sqlite.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\sqlite.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:06.867382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\sqlite.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\sqlite.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1	FAILURE
2016-11-03 00:17:06.867382		LdrLoadDll	basename => sqlite module_address => 0x02da0000 flags => 0 module_name => sqlite.dll	SUCCESS
2016-11-03 00:17:06.867382		NtCreateFile	create_disposition => 3 file_handle => 0x000003ec filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents create_options => 96 status_info => 2 share_access => 3	SUCCESS
2016-11-03 00:17:06.867382		NtCreateFile	create_disposition => 3 file_handle => 0x000003e0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal create_options => 96 status_info => 2 share_access => 0	SUCCESS
2016-11-03 00:17:06.867382		NtWriteFile	buffer => ÙÕù ¡cאê file_handle => 0x000003e0 offset => 0	SUCCESS
2016-11-03 00:17:06.877382		NtWriteFile	buffer => file_handle => 0x000003e0 offset => 0	SUCCESS
2016-11-03 00:17:06.877382		NtWriteFile	buffer => SQLite format 3 @  €ì€j'' tableversion_tableversion_tableCREATE TABLE version_table ( version INTEGER NOT NULL PRIMARY KEY )‚ ## ƒitablepref_eventspref_eventsCREATE TABLE pref_events (event_id INTEGER NOT NULL PRIMARY KEY, event_time INTEGER NOT NULL, instance_guid TEXT NOT NULL, section_name TEXT NOT NULL, pref_key TEXT, pref_value TEXT, client_nonce INTEGER NOT NULL, added INTEGER NOT NULL ) file_handle => 0x000003ec offset => 0	SUCCESS
2016-11-03 00:17:06.877382		NtWriteFile	buffer =>  file_handle => 0x000003ec offset => 0	SUCCESS
2016-11-03 00:17:06.877382		NtWriteFile	buffer => üü file_handle => 0x000003ec offset => 0	SUCCESS
2016-11-03 00:17:06.877382		NtOpenFile	file_handle => 0x000003e0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal open_options => 2113600 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:06.877382		NtOpenFile	file_handle => 0x000003f8 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.877382		CoInitializeEx	options => 2	FAILURE
2016-11-03 00:17:06.877382		CoUninitialize		SUCCESS
2016-11-03 00:17:06.877382		NtOpenFile	file_handle => 0x000003fc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.877382		NtOpenFile	file_handle => 0x000003fc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.877382		NtCreateFile	create_disposition => 3 file_handle => 0x000003fc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.877382		NtOpenFile	file_handle => 0x00000400 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.877382		NtOpenFile	file_handle => 0x00000400 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16385 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:06.887382		NtCreateFile	create_disposition => 3 file_handle => 0x00000404 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal create_options => 96 status_info => 2 share_access => 0	SUCCESS
2016-11-03 00:17:06.887382		NtWriteFile	buffer => ÙÕù ¡c×'p\ file_handle => 0x00000404 offset => 0	SUCCESS
2016-11-03 00:17:06.887382		NtWriteFile	buffer =>  file_handle => 0x00000404 offset => 0	SUCCESS
2016-11-03 00:17:06.887382		NtWriteFile	buffer =>  file_handle => 0x00000404 offset => 0	SUCCESS
2016-11-03 00:17:06.887382		NtWriteFile	buffer => 'p\ file_handle => 0x00000404 offset => 0	SUCCESS
2016-11-03 00:17:06.887382		NtWriteFile	buffer => file_handle => 0x00000404 offset => 0	SUCCESS
2016-11-03 00:17:06.887382		NtWriteFile	buffer => SQLite format 3 @  €ì€j'' tableversion_tableversion_tableCREATE TABLE version_table ( version INTEGER NOT NULL PRIMARY KEY )‚ ## ƒitablepref_eventspref_eventsCREATE TABLE pref_events (event_id INTEGER NOT NULL PRIMARY KEY, event_time INTEGER NOT NULL, instance_guid TEXT NOT NULL, section_name TEXT NOT NULL, pref_key TEXT, pref_value TEXT, client_nonce INTEGER NOT NULL, added INTEGER NOT NULL ) file_handle => 0x00000404 offset => 0	SUCCESS
2016-11-03 00:17:06.887382		NtWriteFile	buffer => 'p\d file_handle => 0x00000404 offset => 0	SUCCESS
2016-11-03 00:17:06.887382		NtOpenFile	file_handle => 0x00000408 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.887382		NtWriteFile	buffer =>  file_handle => 0x00000404 offset => 0	SUCCESS
2016-11-03 00:17:06.887382		NtOpenFile	file_handle => 0x00000408 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.887382		NtWriteFile	buffer => SQLite format 3 @  €ì€j'' tableversion_tableversion_tableCREATE TABLE version_table ( version INTEGER NOT NULL PRIMARY KEY )‚ ## ƒitablepref_eventspref_eventsCREATE TABLE pref_events (event_id INTEGER NOT NULL PRIMARY KEY, event_time INTEGER NOT NULL, instance_guid TEXT NOT NULL, section_name TEXT NOT NULL, pref_key TEXT, pref_value TEXT, client_nonce INTEGER NOT NULL, added INTEGER NOT NULL ) file_handle => 0x000003fc offset => 0	SUCCESS
2016-11-03 00:17:06.887382		NtWriteFile	buffer => ¸¸F M) X’91f93d48979b4a43b7371bd5e29f0b93AVGeneralLastExitNormal file_handle => 0x000003fc offset => 0	SUCCESS
2016-11-03 00:17:06.897382		NtOpenFile	file_handle => 0x00000408 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.897382		NtOpenFile	file_handle => 0x00000404 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal open_options => 2113600 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:06.897382		NtOpenFile	file_handle => 0x000003fc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.897382		NtOpenFile	file_handle => 0x000003fc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.897382		NtCreateFile	create_disposition => 3 file_handle => 0x000003fc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.897382		NtCreateFile	create_disposition => 3 file_handle => 0x00000404 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal create_options => 96 status_info => 2 share_access => 0	SUCCESS
2016-11-03 00:17:06.897382		NtWriteFile	buffer => ÙÕù ¡c×°÷•× file_handle => 0x00000404 offset => 0	SUCCESS
2016-11-03 00:17:06.897382		NtOpenFile	file_handle => 0x00000404 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal open_options => 2113600 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:06.897382		NtOpenFile	file_handle => 0x000003fc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.897382		NtOpenFile	file_handle => 0x000003fc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.897382		NtCreateFile	create_disposition => 3 file_handle => 0x000003fc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.897382		NtCreateFile	create_disposition => 3 file_handle => 0x00000404 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal create_options => 96 status_info => 2 share_access => 0	SUCCESS
2016-11-03 00:17:06.897382		NtWriteFile	buffer => ÙÕù ¡c×$×õN file_handle => 0x00000404 offset => 0	SUCCESS
2016-11-03 00:17:06.897382		NtOpenFile	file_handle => 0x00000404 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal open_options => 2113600 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:06.897382		NtOpenFile	file_handle => 0x000003fc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.897382		NtOpenFile	file_handle => 0x000003fc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.897382		NtCreateFile	create_disposition => 3 file_handle => 0x000003fc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.897382		NtCreateFile	create_disposition => 3 file_handle => 0x00000404 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal create_options => 96 status_info => 2 share_access => 0	SUCCESS
2016-11-03 00:17:06.897382		NtWriteFile	buffer => ÙÕù ¡c×$ðÅ file_handle => 0x00000404 offset => 0	SUCCESS
2016-11-03 00:17:06.897382		NtOpenFile	file_handle => 0x00000404 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal open_options => 2113600 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:06.897382		NtOpenFile	file_handle => 0x000003fc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.907382		NtOpenFile	file_handle => 0x000003fc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.907382		NtCreateFile	create_disposition => 3 file_handle => 0x000003fc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.907382		NtOpenFile	file_handle => 0x00000404 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.907382		NtOpenFile	file_handle => 0x00000404 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.907382		NtCreateFile	create_disposition => 3 file_handle => 0x00000404 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal create_options => 96 status_info => 2 share_access => 0	SUCCESS
2016-11-03 00:17:06.907382		NtWriteFile	buffer => ÙÕù ¡c×F€çœ file_handle => 0x00000404 offset => 0	SUCCESS
2016-11-03 00:17:06.907382		NtOpenFile	file_handle => 0x00000404 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal open_options => 2113600 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:06.907382		NtOpenFile	file_handle => 0x000003fc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.907382		NtOpenFile	file_handle => 0x000003fc filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.907382		NtOpenFile	file_handle => 0x000003fc filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.907382		NtOpenFile	file_handle => 0x000003fc filepath => C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.907382		NtOpenFile	file_handle => 0x000003fc filepath => C:\Program Files\Common Files\Adobe\ARM\1.0\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\ARM\1.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.907382		NtOpenFile	file_handle => 0x0000040c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.907382		NtOpenFile	file_handle => 0x0000040c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.947382		CreateProcessInternalW	thread_identifier => 176 thread_handle => 0x0000043c process_identifier => 1460 current_directory => C:\Documents and Settings\ardi\Local Settings\Temp filepath => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe track => 1 command_line => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:9.0 /MODE:2 filepath_r => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe creation_flags => 67109904 process_handle => 0x00000434 inherit_handles => 0	SUCCESS
2016-11-03 00:17:06.947382		ShellExecuteExW	parameters => /PRODUCT:Reader /VERSION:9.0 /MODE:2 filepath => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" filepath_r => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" show_type => 10	SUCCESS
2016-11-03 00:17:06.997382		NtOpenFile	file_handle => 0x0000043c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.997382		NtOpenFile	file_handle => 0x0000043c filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.997382		NtOpenFile	file_handle => 0x0000043c filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:06.997382		NtOpenFile	file_handle => 0x0000043c filepath => C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:07.157382		LdrLoadDll	basename => Wtsapi32 module_address => 0x76f50000 flags => 0 module_name => Wtsapi32.dll	SUCCESS
2016-11-03 00:17:07.658382		NtCreateFile	create_disposition => 1 file_handle => 0x00000418 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:07.768382		NtOpenFile	file_handle => 0x00000418 filepath => C:\Documents and Settings\ardi\Local Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:07.768382		NtOpenFile	file_handle => 0x00000418 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:07.768382		CoInitializeEx	options => 2	FAILURE
2016-11-03 00:17:07.768382		CoUninitialize		SUCCESS
2016-11-03 00:17:07.768382		NtCreateFile	create_disposition => 5 file_handle => 0x00000418 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\A9R8013.tmp desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\A9R8013.tmp create_options => 96 status_info => 2 share_access => 0	SUCCESS
2016-11-03 00:17:07.768382		NtWriteFile	buffer => %PDF-1.6 %âãÏÓ 1 0 obj <</Pages 2 0 R/Type/Catalog>> endobj 2 0 obj <</Count 0/Kids[]/Type/Pages>> endobj 3 0 obj <<>> endobj xref 0 4 0000000000 65535 f 0000000016 00000 n 0000000061 00000 n 0000000107 00000 n trailer <</Size 4/Root 1 0 R/Info 3 0 R/ID[<287EDA21FC1BA54E9CEC2CE4323733DC><287EDA21FC1BA54E9CEC2CE4323733DC>]>> startxref 127 %%EOF file_handle => 0x00000418 offset => 0	SUCCESS
2016-11-03 00:17:07.768382		NtCreateFile	create_disposition => 1 file_handle => 0x00000418 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\A9R8013.tmp desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\A9R8013.tmp create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:07.778382		NtCreateFile	create_disposition => 1 file_handle => 0x00000424 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:07.848382		NtCreateFile	create_disposition => 1 file_handle => 0x00000424 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:07.909382		NtCreateFile	create_disposition => 1 file_handle => 0x00000424 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:07.959382		NtCreateFile	create_disposition => 1 file_handle => 0x00000424 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:08.199382		NtCreateFile	create_disposition => 1 file_handle => 0x00000424 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api create_options => 96 status_info => 1 share_access => 1	SUCCESS
2016-11-03 00:17:09.721382		NtOpenFile	file_handle => 0x00000424 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap open_options => 16385 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:09.721382		LdrLoadDll	basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll	SUCCESS
2016-11-03 00:17:09.721382		NtOpenFile	file_handle => 0x0000042c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:09.721382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont open_options => 16385 status_info => 4294967295 share_access => 7	FAILURE
2016-11-03 00:17:09.721382		NtOpenFile	file_handle => 0x00000430 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:09.721382		LdrLoadDll	basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll	SUCCESS
2016-11-03 00:17:09.721382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ open_options => 16417 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:09.721382		NtOpenFile	file_handle => 0x0000042c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font open_options => 16385 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:09.721382		LdrLoadDll	basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll	SUCCESS
2016-11-03 00:17:09.721382		NtOpenFile	file_handle => 0x00000440 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:09.721382		NtOpenFile	file_handle => 0x00000440 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:09.721382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ open_options => 16417 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:09.721382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Adobe\Fonts desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\Fonts open_options => 16385 status_info => 4294967295 share_access => 7	FAILURE
2016-11-03 00:17:09.721382		NtOpenFile	file_handle => 0x00000438 filepath => C:\Program Files\Common Files\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:09.721382		LdrLoadDll	basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll	SUCCESS
2016-11-03 00:17:09.721382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Adobe\Fonts\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\Fonts\ open_options => 16417 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:09.721382		NtOpenFile	file_handle => 0x00000440 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap open_options => 16385 status_info => 1 share_access => 7	SUCCESS
2016-11-03 00:17:09.721382		LdrLoadDll	basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll	SUCCESS
2016-11-03 00:17:09.721382		NtOpenFile	file_handle => 0x00000448 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ open_options => 16417 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:09.721382		NtOpenFile	file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Adobe\Fonts\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\Fonts\ open_options => 16417 status_info => 4294967295 share_access => 3	FAILURE
2016-11-03 00:17:26.045382		NtCreateFile	create_disposition => 1 file_handle => 0x00000434 filepath => C:\WINDOWS\system32\spool\drivers\color\sRGB Color Space Profile.icm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\sRGB Color Space Profile.icm create_options => 96 status_info => 1 share_access => 3	SUCCESS
2016-11-03 00:17:56.879382		LdrLoadDll	basename => msimg32 module_address => 0x76380000 flags => 0 module_name => msimg32.dll	SUCCESS
2016-11-03 00:18:03.278382		NtDelayExecution	skipped => 0 milliseconds => 60000	SUCCESS